ORA-00983: cannot audit or noaudit SYS user actions
I want to trace the SYSDBA user by enabling the audit at DB level. On running the command for create session for sys user getting the following error:
SQL> audit create session by sys;
audit create session by sys;
*
ERROR at line 1:
ORA-00983: cannot audit or noaudit SYS user actions
Following are the parameter setting done in the database side:
Show parameter audit
NAME TYPE VALUE ----------------------- ----------- ------------------ audit_sys_operations boolean TRUE audit_file_Dest string C:\ORACLE\ADMIN\XE\ADUMP audit_trail string DB
Solution
SYS auditing is only written in Operating system file. For that AUDIT_TRAIL must be XML,XML EXtended
For auditing the SYS, please follow following steps:
1. set the parameter AUDIT_SYS_OPERATIONS = TRUE
Alter system set audit_sys_operations=TRUE scope=spfile
2. Set the parameter AUDIT_FILE_DEST for location of OS audit file
Alter system set audit_file_dest='C:\auditlog' scope=spfile
3. Set the Paermater AUDIT_TRAIL = XML or XML,Extended
Alter system set audit_trail='XML' scope=spfile
By setting this parameter you start getting Audit trail in audit file destination location.
Note:
1. For AUDIT_SYS_OPERATIONS = TRUE : All audit records for SYS are written to the operating system file that contains the audit trail, and not to SYS.AUD$ (also viewable as DBA_AUDIT_TRAIL).
2. If we set AUDIT_TRAIL = OS then on Windows system, the OS setting writes the audit trail to the Application area of the Windows Event Viewer.
3. Its better to set AUDIT_TRAIL = XML, to get the output in XML files.