Records in audit logs whenever connecting via Toad

Toad for Oracle
1

Hi Experts

I have a scenario here and need your kind advise / assistance to resolve

On one of the Oracle 10gR2 box I enabled the auditing by setting following parameter
audit_trail=db,extended

I created a test user DB_TESTUSER
and set the STATEMENT AUDITING for the same
Audit select table, insert table, delete table, update table by DB_TESTUSER by access;

using toad, i connected with the DB_TESTUSER and before doing query/DML I just query the AUD$ table and found some records query some object in SYS schema.

To confirm I disconnected DB_TESTUSER, truncated the table. Just run “NOAUDIT CREATE SESSION by db_testuser” (even i didn’t enabled the create session auditing) and again connected with the db_testuser. Upon query of AUD$ I found more that 300 records all querying different SYS schema objects.

I truncated the table and using SQLPLUS connected using with the same user (db_testuser), query the AUD$ table and found 4 records querying SYS and SYSTEM objects.

Please see the attached xls sheet.

I need to know why these records are coming in audit log, is there any configuration to disable the logging. Pleas advise.

Regards

Muhammad Khalil[View:/cfs-file/__key/communityserver-discussions-components-files/10/audit-log-generated-while-making-connection-only.xlsx:320:240]

2

Toad runs a lot of queries on startup to see what privileges you have, and to load the GUI with data (To show the list of tables in the Schema Browser, etc). If you want to see what they are, go to Database -> Spool SQL -> Spool to Screen and then make your connection. The queries will be shown at the bottom of Toad.

If you are seeing more audit records than you care to see, then I guess the solution is to fine-tune your auditing settings to only create records for things that you care about.

3

Dear John

Thanks a lot for reply.

I am trying to avoid the records created in the aud$ table while making the connection. currently I have only STATEMENT AUDIT for the user as following

Audit select table, insert table, delete table, update table by DB_TESTUSER by access;

and even with the user I did no operation of any sort, just connected. Any further advise please.

Thanks n Best Regards

4

It sounds like you want to audit only the sql statements that you type into the editor and run there, but not audit Toad’s background queries. There is no way to do that. When you use Toad to login, Toad’s queries are your queries as far as the database is concerned. The database can’t tell the difference.

With that Audit command, you will create an audit record for every select, insert, update, and delete statement made by DB_TESTUSER. If you do the same query again, you’ll get another audit record. If you change your audit statement from BY ACCESS to BY SESSION, then it won’t create duplicate records if you run a query more than once.