I have recently been given the task of building reports from the audits of our Oracle 11g database. While not being the DBA and him being on vacation for a few weeks I have troubles understanding how some informations are recorded.
My main concern is about the os_username and username field. When reading Oracle documentation I see that:
os_username: Operating system login username of the user whose actions were audited
username: Name (not ID number) of the user whose actions were audited.
In the audit_trail I found that os_username contained mostly login username which sure sounds like the definition but also contained entries by "oracle". While the obviously correct os_username had username of what seems to be our systems or things like OEM, the records with a os_username "oracle" all had username entries of login username making this confusing.
In the end, what is the real difference between those 2 columns and on which should I base my query to know how many times a user was recorded?
Any other references I could read on the subject would also be appreciated
Best Answer
The
os_usernameis the name of the user that runs the application. Theusernameis the name of the user defined in the database.Suppose that
UserAis logged on his desktop asUserAand runs an application to modify the data. When he is asked to connect he enters the credentials ofUserB. In the audit you will findUserAasos_usernameandUserBasusername.This explains while you find
oracleasos_usernamesince this is the user that is used to run Oracle itself.