这两天在看有关审计的东西。以前一直没用到。
audit_sys_operations参数为false时，系统只以os文件记录sysdba身份的登录、开关数据库的操作。
win的记录在事件查看器中看。linux的记录在audit_file_dest参数中
SQL> show parameter audit;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /ora/app/ora10g/10.2/admin/ictc/adump
audit_sys_operations                 boolean     TRUE
audit_syslog_level                   string
audit_trail                          string      DB

audit_sys_operations参数为true时，系统以os文件记录sysdba身份的登录、开关数据库的操作，以及其它的操作。

Audit file /ora/app/ora10g/10.2/admin/ictc/adump/ora_28018.aud
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
ORACLE_HOME = /ora/app/ora10g/10.2/
System name:    Linux
Node name:      localhost.localdomain
Release:        2.6.18-8.el5
Version:        #1 SMP Fri Jan 26 14:15:14 EST 2007
Machine:        x86_64
Instance name: ictc
Redo thread mounted by this instance: 1
Oracle process number: 18
Unix process pid: 28018, image: oracle@localhost.localdomain (TNS V1-V3)

Fri Mar 13 10:42:50 2009
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL: pts/1
STATUS: 0

Fri Mar 13 10:43:01 2009
ACTION : 'select sysdate from dual'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL: pts/1
STATUS: 0

Fri Mar 13 10:43:14 2009
ACTION : 'select count(*) from v$process'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL: pts/1
STATUS: 0