C Sybase Adaptive Server Enterprise Audit Events

This appendix contains:

• About the Sybase Adaptive Server Enterprise Audit Events

• Account Management Events

• Application Management Events

• Audit Command Events

• Data Access Events

• Exception Events

• Invalid Record Events

• Object Management Events

• Peer Association Events

• Role and Privilege Management Events

• Service and Application Utilization Events

• System Management Events

• Unknown or Uncategorized Events

• User Session Events

C.1 About the Sybase Adaptive Server Enterprise Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Sybase Adaptive Server Enterprise (ASE). The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

• For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See "Creating a Basic Alert" for more information.

• For custom reports using third-party tools. If you want to create custom reports using other Oracle Database reporting products or third-party tools, then refer to the tables in this appendix when you design the reports. See Chapter 4, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.

C.2 Account Management Events

Account management events track Transact-SQL commands that affect user accounts, such as the UNLOCK ADMIN ACCOUNT command. The Account Management Report, described in Section 3.3.3.2, uses these events.

Table C-1 lists the Sybase ASE account management source database events and the equivalent Oracle Audit Vault events.

Table C-1 Sybase ASE Account Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Login Command	CREATE LOGIN COMMAND DROP LOGIN COMMAND	CREATE USER DROP USER
Set SSA Command	SET SSA COMMAND	ALTER USER
SSO Changed Password	SSO CHANGED PASSWORD	ALTER USER
Unlock Admin Account	UNLOCK ADMIN ACCOUNT	ALTER USER

Table C-2 lists the Sybase ASE account management event attributes.

Table C-2 Sybase ASE Account Management Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_ID	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.3 Application Management Events

Application management events track actions that were performed on the underlying Transact-SQL commands of system services and applications, such as the CREATE RULE command. The Procedure Management Report, described in Section 3.3.3.5, uses these events.

Table C-3 lists the Sybase ASE application management source database events and the equivalent Oracle Audit Vault events.

Table C-3 Sybase ASE Application Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Create Default	CREATE DEFAULT	CREATE DEFAULT
Create Message	CREATE MESSAGE	CREATE MESSAGE
Create Procedure	CREATE PROCEDURE	CREATE PROCEDURE
Create Rule	CREATE RULE	CREATE RULE
Create SQLJ Function	CREATE SQLJ FUNCTION	CREATE FUNCTION
Create Trigger	CREATE TRIGGER	CREATE TRIGGER
Drop Default	DROP DEFAULT	DROP DEFAULT
Drop Message	DROP MESSAGE	DROP MESSAGE
Drop Procedure	DROP PROCEDURE	DROP PROCEDURE
Drop Rule	DROP RULE	DROP RULE
Drop SQLJ Function	DROP SQLJ FUNCTION	DROP FUNCTION
Drop Trigger	DROP TRIGGER	DROP TRIGGER

Table C-4 lists the Sybase ASE application management event attributes.

Table C-4 Sybase ASE Application Management Event Attributes

Attribute Name	Data Type
ASSOCIATED_OBJECT_NAME	VARCHAR2(4000)
ASSOCIATED_OBJECT_OWNER	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
NEW_OBJECT_NAME	VARCHAR2(4000)
NEW_OBJECT_OWNER	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.4 Audit Command Events

Audit command events track the use of auditing Transact-SQL commands on other Transact-SQL commands and on database objects. The Audit Command Report, described in Section 3.3.3.3, uses these events.

Table C-5 lists the Sybase ASE audit command source database events and the equivalent Oracle Audit Vault events.

Table C-5 Sybase ASE Audit Command Audit Events

Event Name Description	Source Event	Audit Vault Event
Auditing Disabled	AUDITING DISABLED	NOAUDIT DEFAULT
Auditing Enabled	AUDITING ENABLED	AUDIT DEFAULT

Table C-6 lists the Sybase ASE audit command event attributes.

Table C-6 Sybase ASE Audit Command Event Attributes

Attribute Name	Data Type
AUDIT_OPTION	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.5 Data Access Events

Data access events track audited Transact-SQL commands, such as all SELECT TABLE, INSERT TABLE, or UPDATE TABLE commands. The Data Access Report, described in Section 3.3.2.3, uses these events.

Table C-7 lists the Sybase ASE data access source database events and the equivalent Oracle Audit Vault events.

Table C-7 Sybase ASE Data Access Audit Events

Event Name Description	Source Event	Audit Vault Event
Access To Audit Table	ACCESS TO AUDIT TABLE	SELECT
BCP In	BCP IN	INSERT
Delete Table	DELETE TABLE	DELETE
Delete View	DELETE VIEW	DELETE
Insert Table	INSERT TABLE	INSERT
Insert View	INSERT VIEW	INSERT
Select Table	SELECT TABLE	SELECT
Select View	SELECT VIEW	SELECT
Truncate Table	TRUNCATE TABLE	TRUNCATE TABLE
Truncation of audit table	TRUNCATION OF AUDIT TABLE	TRUNCATE TABLE
Update Table	UPDATE TABLE	UPDATE
Update View	UPDATE VIEW	UPDATE

Table C-8 lists the Sybase ASE data access event attributes.

Table C-8 Sybase ASE Data Access Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.6 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Activity Report, described in Section 3.3.4.2, uses these events.

Table C-9 lists Sybase ASE exception source database events and the equivalent Oracle Audit Vault events.

Table C-9 Sybase ASE Exception Audit Events

Event Name Description	Source Event	Audit Vault Event
Fatal Error	FATAL ERROR	FATAL ERROR
Nonfatal Error	NONFATAL ERROR	NONFATAL ERROR

Table C-10 lists the Sybase ASE exception event attributes.

Table C-10 Sybase ASE Exception Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.7 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.3.4.3, uses these events.

Table C-11 lists Sybase ASE invalid record event attributes.

Table C-11 Sybase ASE Invalid Record Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
ERROR_ID	NUMBER
ERROR_MESSAGE	VARCHAR2(30)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
MODULE_NAME	VARCHAR2(100)
OBJECT_ID	NUMBER
ORIGINAL_CONTENT2	VARCHAR2(4000)
ORIGINAL_CONTENT3	VARCHAR2(4000)
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SEVERITY	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.8 Object Management Events

Object management events track audited actions performed on database objects, such as CREATE TABLE commands. The Object Management Report, described in Section 3.3.3.4, uses these events.

Table C-12 lists the Sybase ASE object management source database events and the equivalent Oracle Audit Vault events.

Table C-12 Sybase ASE Object Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Access To Database	ACCESS TO DATABASE	ACCESS DATABASE
Alter Table	ALTER TABLE	ALTER TABLE
Bind Default	BIND DEFAULT	ALTER TABLE
Bind Message	BIND MESSAGE	ALTER TABLE
Bind Rule	BIND RULE	ALTER TABLE
Create Index	CREATE INDEX	CREATE INDEX
Create Table	CREATE TABLE	CREATE TABLE
Create View	CREATE VIEW	CREATE VIEW
Drop Index	DROP INDEX	CREATE INDEX
Drop Table	DROP TABLE	DROP TABLE
Drop View	DROP VIEW	DROP VIEW
Unbind Default	UNBIND DEFAULT	ALTER TABLE
Unbind Message	UNBIND MESSAGE	ALTER TABLE
Unbind Rule	UNBIND RULE	ALTER TABLE

Table C-13 lists the Sybase ASE object management event attributes.

Table C-13 Sybase ASE Object Management Event Attributes

Attribute Name	Data Type
ASSOCIATED_OBJECT_NAME	VARCHAR2(4000)
ASSOCIATED_OBJECT_OWNER	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
NEW_OBJECT_NAME	VARCHAR2(4000)
NEW_OBJECT_OWNER	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.9 Peer Association Events

Peer association events track database link commands. The Distributed Database Report, described in Section 3.3.2.5, uses these events. (These events do not have any event names; they only contain event attributes.)

Table C-14 lists the Sybase ASE peer association event attributes.

Table C-14 Sybase ASE Peer Association Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.10 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as revoking permissions from a user to use a specified command. The Role and Privilege Management Report, described in Section 3.3.3.6, uses these events.

Table C-15 lists the Sybase ASE role and privilege management source database events and the equivalent Oracle Audit Vault events.

Table C-15 Sybase ASE Role and Privilege Management Audit Events

Event Name Description	Source Event	Audit Vault Event
Grant Command	GRANT COMMAND	GRANT OBJECT
Revoke Command	REVOKE COMMAND	REVOKE OBJECT
Role Check Performed	ROLE CHECK PERFORMED	CHECK PRIVILEGE
Role Toggling	ROLE TOGGLING	SET ROLE
User-defined Function Command	ALTER ROLE FUNCTION EXECUTED CREATE ROLE FUNCTION EXECUTED DROP ROLE FUNCTION EXECUTED GRANT ROLE FUNCTION EXECUTED REVOKE ROLE FUNCTION EXECUTED	ALTER ROLE CREATE ROLE DROP ROLE GRANT ROLE REVOKE ROLE

Table C-16 lists the Sybase ASE role and privilege management event attributes.

Table C-16 Sybase ASE Role and Privilege Management Event Attributes

Attribute Name	Data Type
ADMIN_OPTION	NUMBER
CONTEXTID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
GRANTEE	VARCHAR2(4000)
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OBJECT_PRIVILEGE	VARCHAR2(255)
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
ROLE_NAME	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
SYSTEM_PRIVILEGE	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.11 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of Transact-SQL commands. The Procedure Executions Report, described in Section 3.3.2.6, uses these events.

Table C-17 lists the Sybase ASE service and application utilization source database events and the equivalent Oracle Audit Vault events.

Table C-17 Sybase ASE Service and Application Utilization Audit Events

Event Name Description	Source Event	Audit Vault Event
Execution Of Stored Procedure	STORED PROCEDURE EXECUTION	EXECUTE PROCEDURE
Execution Of Trigger	TRIGGER EXECUTION	EXECUTE TRIGGER
RPC In	RPC IN	EXECUTE PROCEDURE
RPC Out	RPC OUT	EXECUTE PROCEDURE
Trusted procedure execution	TRUSTED PROCEDURE EXECUTION	EXECUTE PROCEDURE
Trusted trigger execution	TRUSTED TRIGGER EXECUTION	EXECUTE TRIGGER

Table C-18 lists the Sybase ASE service and application utilization event attributes.

Table C-18 Sybase ASE Service and Application Utilization Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.12 System Management Events

System management events track audited system management activity, such as the CREATE DATABASE and DISK INIT commands. The System Management Report, described in Section 3.3.3.7, uses these events.

Table C-19 lists the Sybase ASE system management source database events and the equivalent Oracle Audit Vault events.

Table C-19 Sybase ASE System Management Audit Events

Event Name Description	Source Event	Audit Vault Event
AEK Add Encryption	AEK ADD ENCRYPTION	ALTER SYSTEM
AEK Drop Encryption	AEK DROP ENCRYPTION	ALTER SYSTEM
AEK Key Recovery	AEK KEY RECOVERY	ALTER SYSTEM
AEK Modify Encryption	AEK MODIFY ENCRYPTION	ALTER SYSTEM
AEK Modify Owner	AEK MODIFY OWNER	ALTER SYSTEM
Alter Database	ALTER DATABASE	ALTER DATABASE
Alter Encryption Key	ALTER ENCRYPTION KEY	ALTER SYSTEM
Audit Option Change	AUDIT OPTION CHANGE	AUDIT DEFAULT
Config	CONFIG	ALTER SYSTEM
Create Database	CREATE DATABASE	CREATE DATABASE
Create Encryption Key	CREATE ENCRYPTION KEY	ALTER SYSTEM
DBCC Command	DB CONSISTENCY CHECK	CONSISTENCY CHECK
Deploy UDWS	DEPLOY UDWS	ALTER SYSTEM
Disk Init	DISK INIT	ALTER SYSTEM
Disk Mirror	DISK MIRROR	ALTER SYSTEM
Disk Refit	DISK REFIT	ALTER SYSTEM
Disk Reinit	DISK REINIT	ALTER SYSTEM
Disk Release	DISK RELEASE	ALTER SYSTEM
Disk Remirror	DISK REMIRROR	ALTER SYSTEM
Disk Resize	DISK RESIZE	ALTER SYSTEM
Disk Unmirror	DISK UNMIRROR	ALTER SYSTEM
Drop Database	DROP DATABASE	DROP DATABASE
Drop Encryption Key	DROP ENCRYPTION KEY	ALTER SYSTEM
Dump Database	DUMP DATABASE	BACKUP
Dump Transaction	DUMP TRANSACTION	BACKUP
Encrypted Column Administration	ENCRYPTED COLUMN ADMINISTRATION	ALTER SYSTEM
kill/terminate Command	KILL/TERMINATE COMMAND	ALTER SYSTEM
Load Database	LOAD DATABASE	RESTORE
Load Transaction	LOAD TRANSACTION	RESTORE
Mount Database	MOUNT DATABASE	ALTER DATABASE
Online Database	ONLINE DATABASE	ALTER DATABASE
Quiesce Database Command	QUIESCE DATABASE COMMAND	ALTER SYSTEM
Server Boot	SERVER BOOT	STARTUP
Server Shutdown	SERVER SHUTDOWN	SHUTDOWN
SSL Administration	SSL ADMINISTRATION	ALTER SYSTEM
Undeploy UDWS	UNDEPLOY UDWS	ALTER SYSTEM
Unmount Database	UNMOUNT DATABASE	ALTER DATABASE

Table C-20 lists the Sybase ASE system management event attributes.

Table C-20 Sybase ASE System Management Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.13 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized. The Uncategorized Activity Report, described in Section 3.3.4.4, uses these events.

Table C-21 shows the Sybase ASE unknown or uncategorized source database event and the equivalent Oracle Audit Vault event.

Table C-21 Sybase ASE Unknown or Uncategorized Audit Events

Event Name Description	Source Event	Audit Vault Event
Ad Hoc Audit record	AD HOC AUDIT RECORD	UNKNOWN

Table C-22 lists the Sybase ASE unknown or uncategorized event attributes.

Table C-22 Sybase ASE Unknown or Uncategorized Event Attributes

Attribute Name	Data Type
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)

C.14 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.2.7, uses these events.

Table C-23 lists the Sybase ASE user session source database events and the equivalent Oracle Audit Vault events.

Table C-23 Sybase ASE User Session Audit Events

Event Name Description	Source Event	Audit Vault Event
Connect to command	CONNECT TO COMMAND	CREATE SESSION
Log In	LOG IN	LOGON
Log Out	LOG OUT	LOGOFF
Setuser Command	SETUSER COMMAND	IMPERSONATION

Table C-24 lists the Sybase ASE user session event attributes.

Table C-24 Sybase ASE User Session Event Attributes

Attribute Name	Data Type
AUTHENTICATION_METHOD	VARCHAR2(255)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CURRENT_VALUE	VARCHAR2(4000)
DATABASE_ID	NUMBER
DATABASE_NAME	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_MOD	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
KEYWORD	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PREVIOUS_VALUE	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_INFORMATION	VARCHAR2(4000)
SEQUENCE	VARCHAR2(4000)
SOURCE_EVENTID	VARCHAR2(255)
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
USER_GUID	VARCHAR2(4000)
USERNAME	VARCHAR2(4000)