cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Kuberski
New Member
Member since: ‎05-13-2015
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎05-13-2015
Activity Feed
Topics I've Started
View All

Re: Oracle database....who am i

by in All Apps and Add-ons
‎05-13-2015 01:23 PM
‎05-13-2015 01:23 PM
I didn't think it was possible since it is how oracle does auditing. Each user does have an individual account that they are supposed to be using to connect into the database that would provide the auditing information in detail that would be required. However we all know that not all users will use this method and "su - oracle" to get to the database occasionally. What we are trying to do is report on those occasions. As far as the SYSTEM account, yes each user is supposed to be using their individual created account that has the a default role and dba role that they can set if needed. We wanted this alert though to see if they are using SYSTEM instead of their individual account. ... View more

Oracle database....who am i

by in All Apps and Add-ons
‎05-13-2015 12:42 PM
‎05-13-2015 12:42 PM
Writing a SPLUNK alert for SYSTEM logon to an Oracle database with oracle auditing turned on. Issue is that on the unix server box all users login with there id to the box and then "su - oracle" to connect to the id that runs the oracle instance. When you run the alert in SPLUNK it shows the user as ORACLE which is the correct command returned from "whoami". However what I would like is to have the command returned from "who am i" as this is the real user logged into the box that is the ORACLE account. Is this possible to do? whoami oracle who am i rjk5555 pts/10 May 13 13:50 (mypc.domain.com) ============================================== (index=oracle OR index=dblogs) sourcetype=oracle:audit <DB_User>SYSTEM</DB_User> ("<Action>100</Action>" OR "<Action>129</Action>") | xmlkv | eval Rpt_Time = strftime (_time , "%Y/%m/%d %H:%M:%S %a") | eval DB_Server = host | eval empid = OS_User | rename Action AS Action_ID | lookup oracle-action-map Action_ID OUTPUT Action_Name | TABLE OS_User, DB_User, oracle_sid, DB_Server, Userhost, Rpt_Time, Action_ID, Action_Name ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM