Skip Headers

Oracle® Audit Vault Auditor's Guide 10g Release 2 (10.2.2) Part Number B28853-02 |
Home | Book List | Contents | Index | Contact Us

Previous | Next
| View PDF

# B Oracle Database Audit Events

When creating alerts, you can specify the type of alerts that are triggered based on event category. If an audit event category is selected, you can choose the attribute of the alert to be fine-grained. You use audit event categories in the Advanced Alert Condition section of the Create Alert Rule Page.

This appendix contains reference information about audit events. It includes the following sections:

- Attributes by Event Category

- Source Event IDs

## B.1 Attributes by Event Category

This section lists event attributes, by event category, and their attribute types. The event categories are:

- Account Management Event Attributes

- Application Management Event Attributes

- Audit Command Event Attributes

- Data Access Event Attributes

- Exceptional Event Attributes

- Invalid Record Event Attributes

- Object Management Event Attributes

- Peer Association Event Attributes

- Role and Privilege Management Event Attributes

- Service and Application Utilization Event Attributes

- System Management Event Attributes

- Unknown or Uncategorized Event Attributes

- User Session Event Attributes

### B.1.1 Account Management Event Attributes

Account management event attributes are shown in Table B-1.

Table B-1 Account Management Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.2 Application Management Event Attributes

Application management event attributes are shown in Table B-2.

Table B-2 Application Management Event Attributes

Attribute Name | Attribute Type
--- | ---
associated_object_name | VARCHAR2(4000)
associated_object_owner | VARCHAR2(4000)
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
new_object_name | VARCHAR2(4000)
new_object_owner | VARCHAR2(4000)
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bind Foot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.3 Audit Command Event Attributes

Audit command event attributes are shown in Table B-3.

Table B-3 Audit Command Event Attributes

Attribute Name | Attribute Type
--- | ---
audit_option | VARCHAR2(4000)
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_text Foot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.4 Data Access Event Attributes

Data access event attributes are shown in Table B-4.

Table B-4 Data Access Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
col_namelist | VARCHAR2(4000)
col_newval1 | VARCHAR2(4000)
col_newval10 | VARCHAR2(4000)
col_newval11 | VARCHAR2(4000)
col_newval2 | VARCHAR2(4000)
col_newval3 | VARCHAR2(4000)
col_newval4 | VARCHAR2(4000)
col_newval5 | VARCHAR2(4000)
col_newval6 | VARCHAR2(4000)
col_newval7 | VARCHAR2(4000)
col_newval8 | VARCHAR2(4000)
col_newval9 | VARCHAR2(4000)
col_oldval1 | VARCHAR2(4000)
col_oldval10 | VARCHAR2(4000)
col_oldval11 | VARCHAR2(4000)
col_oldval2 | VARCHAR2(4000)
col_oldval3 | VARCHAR2(4000)
col_oldval4 | VARCHAR2(4000)
col_oldval5 | VARCHAR2(4000)
col_oldval6 | VARCHAR2(4000)
col_oldval7 | VARCHAR2(4000)
col_oldval8 | VARCHAR2(4000)
col_oldval9 | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
data_values | AV_DATAVALUES_LIST
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
fga_policyname | VARCHAR2(30)
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
num_inlinecol | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
row_id | VARCHAR2(18)
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
transaction_name | VARCHAR2(256)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.5 Exceptional Event Attributes

Exceptional event attributes are shown in Table B-5.

Table B-5 Exceptional Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_text Foot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.6 Invalid Record Event Attributes

Invalid record event attributes are shown in Table B-6.

Table B-6 Invalid Record Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
enduser | NUMBER
error_message | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
module_name | VARCHAR2(100)
object_id | NUMBER
original_content1 | VARCHAR2(4000)
original_content2 | VARCHAR2(4000)
original_content3 | VARCHAR2(4000)
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
severity | NUMBER
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.7 Object Management Event Attributes

Object management event attributes are shown in Table B-7.

Table B-7 Object Management Event Attributes

Attribute Name | Attribute Type
--- | ---
associated_object_name | VARCHAR2(4000)
associated_object_owner | VARCHAR2(4000)
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
new_object_name | VARCHAR2(4000)
new_object_owner | VARCHAR2(4000)
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.8 Peer Association Event Attributes

Peer association event attributes are shown in Table B-8.

Table B-8 Peer Association Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.9 Role and Privilege Management Event Attributes

Role and privilege management event attributes are shown in Table B-9.

Table B-9 Role and Privilege Management Event Attributes

Attribute Name | Attribute Type
--- | ---
admin_option | NUMBER
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME
grantee | VARCHAR2(4000)
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
object_privilege | VARCHAR2(255)
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
role_name | VARCHAR2(4000)
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
system_privilege | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.10 Service and Application Utilization Event Attributes

Service and application utilization event attributes are shown in Table B-10.

Table B-10 Service and Application Utilization Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_text Foot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.11 System Management Event Attributes

System management event attributes are shown in Table B-11.

Table B-11 System Management Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.12 Unknown or Uncategorized Event Attributes

Unknown or uncategorized event attributes are shown in Table B-12.

Table B-12 Unknown or Uncategorized Event Attributes

Attribute Name | Attribute Type
--- | ---
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bind Foot 1 | VARCHAR2(4000)
sql_text Foot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

### B.1.13 User Session Event Attributes

User session event attributes are shown in Table B-13.

Table B-13 User Session Event Attributes

Attribute Name | Attribute Type
--- | ---
authentication_method | VARCHAR2(255)
client_appinfo | VARCHAR2(4000)
client_id | VARCHAR2(4000)
comment_text | VARCHAR2(4000)
contextid | VARCHAR2(4000)
enduser | VARCHAR2(4000)
event_status | VARCHAR2(30)
event_time | TIMESTAMP WITH LOCAL TIME ZONE
host_ip | VARCHAR2(255)
host_name | VARCHAR2(255)
host_terminal | VARCHAR2(255)
instance_number | NUMBER
logoff_dlock | NUMBER
logoff_lread | NUMBER
logoff_lwrite | NUMBER
logoff_pread | NUMBER
object_id | NUMBER
osuser_name | VARCHAR2(4000)
parent_contextid | VARCHAR2(4000)
privileges_used | VARCHAR2(4000)
process# | NUMBER
proxy_sessionid | NUMBER
scn | NUMBER
session_actions | VARCHAR2(255)
source_eventid | VARCHAR2(255)
sql_bindFoot 1 | VARCHAR2(4000)
sql_textFoot 2 | VARCHAR2(4000)
statementid | NUMBER
sub_contextid | VARCHAR2(4000)
target_object | VARCHAR2(4000)
target_owner | VARCHAR2(4000)
thread# | NUMBER
tools_used | VARCHAR2(4000)
undo_sql_text | VARCHAR2(4000)
user_guid | VARCHAR2(32)
username | VARCHAR2(4000)

Footnote 1 sql_bind variable could be truncated to 4000 characters.

Footnote 2 sql_text variable could be truncated to 4000 characters.

## B.2 Source Event IDs

Source event IDs are numbers that represent the events in each category. A logon event, for example, is specified as:

    SOURCE_EVENTID = '100'

This section lists events, by category, and their corresponding Oracle Database (ORCLDB) events. The event categories are:

- Account Management Events

- Application Management Events

- Audit Events

- Data Access Events

- Exceptional Events

- Invalid Record Events

- Object Management Events

- Peer Association Events

- Role and Privilege Management Events

- Service and Application Utilization Events

- System Management Events

- Unknown or Uncategorized Events

- User Session Events

### B.2.1 Account Management Events

Account management events and event IDs are shown in Table B-1.

Table B-14 Account Management Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER PROFILE | 67
ALTER USER | 43
CREATE PROFILE | 65
CREATE USER | 51
DROP PROFILE | 66
DROP USER | 53

### B.2.2 Application Management Events

Application management events and event IDs are shown in Table B-15.

Table B-15 Application Management Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER FUNCTION | 92
ALTER JAVA | 161
ALTER PACKAGE | 95
ALTER PACKAGE BODY | 98
ALTER PROCEDURE | 25
ALTER RESOURCE COST | 70
ALTER REWRITE EQUIVALENCE | 210
ALTER TRIGGER | 60
ALTER TYPE | 80
ALTER TYPE BODY | 82
ANALYZE INDEX | 63
ANALYZE TABLE | 62
ASSOCIATE STATISTICS | 168
CREATE CONTEXT | 177
CREATE FUNCTION | 91
CREATE INDEXTYPE | 164
CREATE JAVA | 160
CREATE LIBRARY | 159
CREATE OPERATOR | 163
CREATE PACKAGE | 94
CREATE PACKAGE BODY | 97
CREATE PROCEDURE | 24
CREATE TRIGGER | 59
CREATE TYPE | 77
CREATE TYPE BODY | 81
DECLARE REWRITE EQUIVALENCE | 209
DISABLE TRIGGER | 119
DISASSOCIATE STATISTICS | 169
DROP CONTEXT | 178
DROP FUNCTION | 93
DROP INDEXTYPE | 165
DROP JAVA | 162
DROP LIBRARY | 84
DROP OPERATOR | 167
DROP PACKAGE | 96
DROP PACKAGE BODY | 99
DROP PROCEDURE | 68
DROP REWRITE EQUIVALENCE | 211
DROP TRIGGER | 61
DROP TYPE | 78
DROP TYPE BODY | 83
ENABLE TRIGGER | 118
EXECUTE TYPE | 123
EXPLAIN | 50

### B.2.3 Audit Events

Audit events and event IDs are shown in Table B-16.

Table B-16 Audit Events and Event IDs

Event | ORCLDB Event ID
--- | ---
AUDIT DEFAULT | 106
AUDIT OBJECT | 30
NOAUDIT DEFAULT | 107
NOAUDIT OBJECT | 31
SYSTEM AUDIT | 104
SYSTEM NOAUDIT | 105

### B.2.4 Data Access Events

Data access events and event IDs are shown in Table B-17.

Table B-17 Data Access Events and Event IDs

Event | ORCLDB Event ID
--- | ---
DELETE | 7
INSERT | 2
SELECT | 3
TRUNCATE TABLE | 85
UPDATE | 6

### B.2.5 Exceptional Events

Exceptional events and event IDs are shown in Table B-18.

Table B-18 Exceptional Events and Event IDs

Event | ORCLDB Event ID
--- | ---
NETWORK ERROR | 122

### B.2.6 Invalid Record Events

Invalid record events and event IDs are shown in Table B-19.

Table B-19 Invalid Record Events and Event IDs

Event | ORCLDB Event ID
--- | ---
INVALID RECORD | 30000

### B.2.7 Object Management Events

Object management events and event IDs are shown in Table B-20.

Table B-20 Object Management Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER DIMENSION | 175
ALTER INDEX | 11
ALTER MATERIALIZED VIEW | 75
ALTER MATERIALIZED VIEW LOG | 72
ALTER OPERATOR | 183
ALTER OUTLINE | 179
ALTER SEQUENCE | 14
ALTER TABLE | 15
CREATE DIMENSION | 174
CREATE DIRECTORY | 157
CREATE INDEX | 9
CREATE MATERIALIZED VIEW | 74
CREATE MATERIALIZED VIEW LOG | 71
CREATE OUTLINE | 180
CREATE PUBLIC DATABASE LINK | 112
CREATE PUBLIC SYNONYM | 110
CREATE SCHEMA | 56
CREATE SEQUENCE | 13
CREATE SYNONYM | 19
CREATE TABLE | 1
CREATE VIEW | 21
DROP DIMENSION | 176
DROP DIRECTORY | 158
DROP INDEX | 10
DROP MATERIALIZED VIEW | 76
DROP MATERIALIZED VIEW LOG | 73
DROP OUTLINE | 181
DROP PUBLIC DATABASE LINK | 113
DROP PUBLIC SYNONYM | 111
DROP SEQUENCE | 16
DROP SYNONYM | 20
DROP TABLE | 12
DROP VIEW | 22
FLASHBACK TABLE | 205
LOCK | 26
PURGE INDEX | 201
PURGE TABLE | 200
RENAME | 28
UNDROP OBJECT | 202
UPDATE INDEXES | 182
VALIDATE INDEX | 23

### B.2.8 Peer Association Events

Peer association events and event IDs are shown in Table B-21.

Table B-21 Peer Association Events and Event IDs

Event | ORCLDB Event ID
--- | ---
CREATE DATABASE LINK | 32
DROP DATABASE LINK | 33

### B.2.9 Role and Privilege Management Events

Role and privilege management events and event IDs are shown in Table B-22.

Table B-22 Role and Privilege Management Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER ROLE | 79
CREATE ROLE | 52
DROP ROLE | 54
GRANT OBJECT | 17
GRANT ROLE | 114
REVOKE OBJECT | 18
REVOKE ROLE | 115

### B.2.10 Service and Application Utilization Events

Service and application utilization events and event IDs are shown in Table B-23.

Table B-23 Service and Application Utilization Events and Event IDs

Event | ORCLDB Event ID
--- | ---
CALL METHOD | 170
EXECUTE PROCEDURE | 116
PL/SQL EXECUTE | 47

### B.2.11 System Management Events

System management events and event IDs are shown in Table B-24.

Table B-24 System Management Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER CLUSTER | 5
ALTER DATABASE | 35
ALTER ROLLBACK SEG | 37
ALTER SYSTEM | 49
ALTER TABLESPACE | 40
ANALYZE CLUSTER | 64
CREATE CLUSTER | 4
CREATE CONTROL FILE | 57
CREATE DATABASE | 34
CREATE ROLLBACK SEG | 36
CREATE TABLESPACE | 39
DISABLE ALL TRIGGERS | 121
DROP CLUSTER | 8
DROP ROLLBACK SEG | 38
DROP TABLESPACE | 41
ENABLE ALL TRIGGERS | 120
FLASHBACK | 128
FLASHBACK DATABASE | 204
PURGE DBA_RECYCLEBIN | 198
PURGE TABLESPACE | 199
SHUTDOWN | 216
STARTUP | 215
SUPER USER DDL | 213
SUPER USER DML | 214
SYSTEM GRANT | 108
SYSTEM REVOKE | 109
TRUNCATE CLUSTER | 86

### B.2.12 Unknown or Uncategorized Events

Unknown or uncategorized events and event IDs are shown in Table B-25.

Table B-25 Unknown or Uncategorized Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER SUMMARY | 172
COMMENT | 29
CREATE SUMMARY | 171
DROP SUMMARY | 173
NO-OP | 27
SUPER USER UNKNOWN | 217
UNKNOWN | 0
USER COMMENT | 117

### B.2.13 User Session Events

User session events and event IDs are shown in Table B-26.

Table B-26 User Session Events and Event IDs

Event | ORCLDB Event ID
--- | ---
ALTER SESSION | 42
COMMIT | 44
CREATE RESTORE POINT | 206
CREATE SESSION | 129
DROP RESTORE POINT | 207
LOGOFF | 101
LOGOFF BY CLEANUP | 102
LOGON | 100
PROXY AUTHENTICATION ONLY | 208
PURGE USER_RECYCLEBIN | 197
ROLLBACK | 45
SAVEPOINT | 46
SESSION REC | 103
SET ROLE | 55
SET TRANSACTION | 48
SUPER USER LOGON | 212