USER xxx is being audited for all SELECTS in alert log


There are some (or many) messages in the alert.log as follows:
USER 231 is being audited for all SELECTS
USER 231 is being audited for all SELECTS
Tue Sep 23 16:18:13 2014
USER 232 is being audited for all SELECTS
USER 232 is being audited for all SELECTS
The cause is best explained with a simple example:
- issue as user SYS: 

SQL> audit select table by scott;
Audit succeeded.

- written to the alert.log file:

Tue Sep 09 13:34:35 2014
USER 232 is being audited for all SELECTS
The reason is this message originates from the transaction layer, when such an AUDIT SELECT TABLE BY &username is issued, all cached statements are being invalidated, this is reported to the alert.log.
This is not a bug, however if many such messages are being written to the alert.log file, it can make it difficult to read.
Solution:
If it is required to run an automated AUDIT statement for a particular user from a job or otherwise, the recommendation is to make this conditional, first check if the required audit option is already set for the user and then decide to issue an AUDIT statement or not, for example:
SQL> select * from DBA_STMT_AUDIT_OPTS  where user_name like 'SS_%' and audit_option='SELECT TABLE'
  COUNT(*)
----------
         13
MOS: Why are there Audit Log Messages In the Alert.log like: USER xx is being audited for all SELECTS (Doc ID 1497187.1)
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: