Oracle 11g standard audit to syslog: what is normal for single quotes?

[jldunn]

We are using Oracle 11g standard audit to syslog on a Unix server. I am seeing a small number of Oracle records that don't have trailing quotes in the syslog file, e.g.:

2013 Nov 6 03:00:01 hostname [local7.warning] Audit[30801972]: LENGTH : '203' ACTION :[55] 'alter session set remote_dependencies_mode = signature

Note that there is an opening single quote before "alter" but not a closing trailing quote.
Our DBA team doesn't know if this is 'normal' for Oracle audit records or not.
Is it 'normal' for an audit record to be missing a trailing quote?

I have not seen other records (non-Oracle) truncated by our syslog, so I am not suspecting syslog at this point. The records appear to be of differing lengths; i.e. they aren't all getting chopped off at a specific point.

[pmdba]

I would not say that this is normal. The syslog output format may be dependent on your particular flavor of UNIX, or your particular syslog configuration. The systems I have tested this on (RHEL 5, RHEL 6, OEL 5) all include the trailing quote, as well as several more fields (see below). I would recommend checking your syslog or rsyslog configuration to make sure there isn't some issue there. It may also be that Oracle is sending a character that has special meaning to syslog that causes it to truncate the entry. Check the full SQL statement being used to see if there is anything unusual about it.

Dec 3 14:46:31 hostname Oracle Audit[11872]: LENGTH : '233' ACTION :[85] 'alter system set "_shutdown_completion_timeout_mins" = 30 scope=memory /* db agent */' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[10] '1773000810'

[lguinn2]

You might also want to ask this on an Oracle forum. I don't think that many in this community are Oracle admins.