All Apps and Add-ons

Oracle 11g standard audit to syslog: what is normal for single quotes?


We are using Oracle 11g standard audit to syslog on a Unix server. I am seeing a small number of Oracle records that don't have trailing quotes in the syslog file, e.g.:

2013 Nov 6 03:00:01 hostname [local7.warning] Audit[30801972]: LENGTH : '203' ACTION :[55] 'alter session set remote_dependencies_mode = signature

Note that there is an opening single quote before "alter" but not a closing trailing quote.
Our DBA team doesn't know if this is 'normal' for Oracle audit records or not.
Is it 'normal' for an audit record to be missing a trailing quote?

I have not seen other records (non-Oracle) truncated by our syslog, so I am not suspecting syslog at this point. The records appear to be of differing lengths; i.e. they aren't all getting chopped off at a specific point.


I would not say that this is normal. The syslog output format may be dependent on your particular flavor of UNIX, or your particular syslog configuration. The systems I have tested this on (RHEL 5, RHEL 6, OEL 5) all include the trailing quote, as well as several more fields (see below). I would recommend checking your syslog or rsyslog configuration to make sure there isn't some issue there. It may also be that Oracle is sending a character that has special meaning to syslog that causes it to truncate the entry. Check the full SQL statement being used to see if there is anything unusual about it.

Dec 3 14:46:31 hostname Oracle Audit[11872]: LENGTH : '233' ACTION :[85] 'alter system set "_shutdown_completion_timeout_mins" = 30 scope=memory /* db agent */' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[10] '1773000810'

0 Karma


You might also want to ask this on an Oracle forum. I don't think that many in this community are Oracle admins.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...