I was hit yesterday with a question . How do we know if someone executes a query or a system call.
since i've not been using 1-g that often. idecided to dig into ash and see all the data the oracle collects.
it was a interesting experience but i still found that oracle misses somestuff maybe becuase i was looking at wrh$_active_session_history which i'm not sure how prunes out what to keep and what not.
but i found some 'alter system' and 'alter session' commands from dba_hist_sqltext and i' didnt find some,
this seemed like a problem. i know the alter system happened since the alert log has a record.
i'll update this post as i find more and maybe someone can comment on this is they have found descrapancies and what and how to secure a system and find out if someone has stolen the sys/system password or just a bad judegement call from the dba's end .
lutz hartmann this week: Active Session History in Oracle 10gR1+2