Skip Headers

Oracle® Audit Vault Auditor's Guide Release 10.2.3 Part Number E11058-01 |
Home | Book List | Contents | Index | Contact Us

Previous | Next
| View PDF

# B Oracle Database Audit Events

This appendix contains:

- About the Oracle Database Audit Events

- Account Management Events

- Application Management Events

- Audit Command Events

- Data Access Events

- Oracle Database Vault Events

- Exception Events

- Invalid Record Events

- Object Management Events

- Peer Association Events

- Role and Privilege Management Events

- Service and Application Utilization Events

- System Management Events

- Unknown or Uncategorized Events

- User Session Events

## B.1 About the Oracle Database Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Oracle Database. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

- For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See Section 2.11.2 for more information.

- For custom reports using third-party tools. If you want to create custom reports using third-party tools, refer to the tables in this appendix when you design the reports. See Appendix A, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.

## B.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as creating users or altering their profiles. The Account Management Report, described in Section 3.4.1, uses these events.

Table B-1 lists the Oracle Database account management events and event IDs.

Table B-1 Oracle Database Account Management Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER PROFILE` | `67`
`ALTER USER` | `43`
`CREATE PROFILE` | `65`
`CREATE USER` | `51`
`DROP PROFILE` | `66`
`DROP USER` | `53`

Table B-2 lists the Oracle Database account management event attributes.

Table B-2 Oracle Database Account Management Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.3 Application Management Events

Application management events track actions that were performed on the underlying PL/SQL procedures or functions of system services and applications, such as `ALTER FUNCTION` statements. The Procedure Management Report, described in Section 3.4.4, uses these events.

Table B-3 lists the Oracle Database application management events and event IDs.

Table B-3 Oracle Database Application Management Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER FUNCTION` | `92`
`ALTER JAVA` | `161`
`ALTER PACKAGE` | `95`
`ALTER PACKAGE BODY` | `98`
`ALTER PROCEDURE` | `25`
`ALTER RESOURCE COST` | `70`
`ALTER REWRITE EQUIVALENCE` | `210`
`ALTER TRIGGER` | `60`
`ALTER TYPE` | `80`
`ALTER TYPE BODY` | `82`
`ANALYZE INDEX` | `63`
`ANALYZE TABLE` | `62`
`ASSOCIATE STATISTICS` | `168`
`CREATE CONTEXT` | `177`
`CREATE FUNCTION` | `91`
`CREATE INDEXTYPE` | `164`
`CREATE JAVA` | `160`
`CREATE LIBRARY` | `159`
`CREATE OPERATOR` | `163`
`CREATE PACKAGE` | `94`
`CREATE PACKAGE BODY` | `97`
`CREATE PROCEDURE` | `24`
`CREATE TRIGGER` | `59`
`CREATE TYPE` | `77`
`CREATE TYPE BODY` | `81`
`DECLARE REWRITE EQUIVALENCE` | `209`
`DISABLE TRIGGER` | `119`
`DISASSOCIATE STATISTICS` | `169`
`DROP CONTEXT` | `178`
`DROP FUNCTION` | `93`
`DROP INDEXTYPE` | `165`
`DROP JAVA` | `162`
`DROP LIBRARY` | `84`
`DROP OPERATOR` | `167`
`DROP PACKAGE` | `96`
`DROP PACKAGE BODY` | `99`
`DROP PROCEDURE` | `68`
`DROP REWRITE EQUIVALENCE` | `211`
`DROP TRIGGER` | `61`
`DROP TYPE` | `78`
`DROP TYPE BODY` | `83`
`ENABLE TRIGGER` | `118`
`EXECUTE TYPE` | `123`
`EXPLAIN` | `50`

Table B-4 lists the Oracle Database application management event attributes.

Table B-4 Oracle Database Application Management Event Attributes

Attribute Name | Data Type
--- | ---
`ASSOCIATED_OBJECT_NAME` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER` | `VARCHAR2(4000)`
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`NEW_OBJECT_NAME` | `VARCHAR2(4000)`
`NEW_OBJECT_OWNER` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.4 Audit Command Events

Audit command events track the use of `AUDIT` SQL statements on other SQL statements and on database objects. The Audit Command Report, described in Section 3.4.2, uses these events.

Table B-5 lists the Oracle Database audit events and event IDs.

Table B-5 Oracle Database Audit Events and Event IDs

Event Name | Event ID
--- | ---
`AUDIT DEFAULT` | `106`
`AUDIT OBJECT` | `30`
`NOAUDIT DEFAULT` | `107`
`NOAUDIT OBJECT` | `31`
`SYSTEM AUDIT` | `104`
`SYSTEM NOAUDIT` | `105`

Table B-6 lists the Oracle Database audit command event attributes.

Table B-6 Oracle Database Audit Command Event Attributes

Attribute Name | Data Type
--- | ---
`AUDIT_OPTION` | `VARCHAR2(4000)`
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.5 Data Access Events

Data access events track audited data manipulation language (DML) activities, for example, all `SELECT`, `INSERT`, `UPDATE`, or `DROP` SQL statements. The Data Access Report, described in Section 3.3.2, uses these events.

Table B-7 lists the Oracle Database data access events and event IDs.

Table B-7 Oracle Database Data Access Events and Event IDs

Event Name | Event ID
--- | ---
`DELETE` | `7`
`INSERT` | `2`
`SELECT` | `3`
`TRUNCATE TABLE` | `85`
`UPDATE` | `6`

Table B-8 lists the Oracle Database data access event attributes.

Table B-8 Oracle Database Data Access Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COL_NAMELIST` | `VARCHAR2(4000)`
`COL_NEWVAL1` | `VARCHAR2(4000)`
`COL_NEWVAL10` | `VARCHAR2(4000)`
`COL_NEWVAL11` | `VARCHAR2(4000)`
`COL_NEWVAL2` | `VARCHAR2(4000)`
`COL_NEWVAL3` | `VARCHAR2(4000)`
`COL_NEWVAL4` | `VARCHAR2(4000)`
`COL_NEWVAL5` | `VARCHAR2(4000)`
`COL_NEWVAL6` | `VARCHAR2(4000)`
`COL_NEWVAL7` | `VARCHAR2(4000)`
`COL_NEWVAL8` | `VARCHAR2(4000)`
`COL_NEWVAL9` | `VARCHAR2(4000)`
`COL_OLDVAL1` | `VARCHAR2(4000)`
`COL_OLDVAL10` | `VARCHAR2(4000)`
`COL_OLDVAL11` | `VARCHAR2(4000)`
`COL_OLDVAL2` | `VARCHAR2(4000)`
`COL_OLDVAL3` | `VARCHAR2(4000)`
`COL_OLDVAL4` | `VARCHAR2(4000)`
`COL_OLDVAL5` | `VARCHAR2(4000)`
`COL_OLDVAL6` | `VARCHAR2(4000)`
`COL_OLDVAL7` | `VARCHAR2(4000)`
`COL_OLDVAL8` | `VARCHAR2(4000)`
`COL_OLDVAL9` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`DATA_VALUES` | `AV_DATAVALUES_LIST`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`FGA_POLICYNAME` | `VARCHAR2(30)`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`NUM_INLINECOL` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`ROW_ID` | `VARCHAR2(18)`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRANSACTION_NAME` | `VARCHAR2(256)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.6 Oracle Database Vault Events

Oracle Database Vault events track audited Oracle Database Vault activity. The Oracle Database Vault Report, described in Section 3.3.3, uses these events.

Table B-9 lists the Oracle Database Vault events and event IDs.

Table B-9 Oracle Database Vault Events and Event IDs

Event Name | Event ID
--- | ---
`FACTOR EVALUATION` | `1000`
`FACTOR ASSIGNMENT` | `1001`
`FACTOR EXPRESSION` | `1002`
`REALM VIOLATION` | `1003`
`REALM AUTHORIZATION` | `1004`
`COMMAND AUTHORIZATION` | `1005`
`SECURE ROLE` | `1006`
`LBL SEC SESSION INIT` | `1007`
`ACCESS CTRL COMMAND AUTH` | `1008`
`ACCESS CTRL SESSION INIT` | `1009`
`LBL SEC ATTEMPT TO UPGRADE` | `1010`

Table B-10 lists the Oracle Database Vault event attributes.

Table B-10 Oracle Database Vault Event Attributes

Attribute Name | Data Type
--- | ---
`ACTION_NAME` | `VARCHAR2(128)`
`ACTION_OBJECT_ID` | `NUMBER`
`ACTION_OBJECT_NAME` | `VARCHAR2(128)`
`ACTION_COMMAND` | `VARCHAR2(4000)`
`AUDIT_OPTION` | `VARCHAR2(4000)`
`RULE_SET_ID` | `NUMBER`
`RULE_SET_NAME` | `VARCHAR2(90)`
`RULE_ID` | `NUMBER`
`RULE_NAME` | `VARCHAR2(90)`
`FACTOR_CONTEXT` | `VARCHAR2(4000)`
`CREATED_BY` | `VARCHAR2(30)`
`CREATE_DATE` | `TIMESTAMP WITH LOCAL TIME ZONE`
`UPDATED_BY` | `VARCHAR2(30)`
`UPDATE_DATE` | `TIMESTAMP WITH LOCAL TIME ZONE`

## B.7 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Report, described in Section 3.5.1, uses these events.

Table B-11 lists the Oracle Database exception events and event IDs.

Table B-11 Oracle Database Exceptional Events and Event IDs

Event Name | Event ID
--- | ---
`NETWORK ERROR` | `122`

Table B-12 lists the Oracle Database exception event attributes.

Table B-12 Oracle Database Exceptional Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.8 Invalid Record Events

Invalid record events track audited activity that Audit Vault could not understand, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.5.2, uses these events.

Table B-13 lists the Oracle Database invalid record events and event IDs.

Table B-13 Oracle Database Invalid Record Events and Event IDs

Event Name | Event ID
--- | ---
`INVALID RECORD` | `30000`

Table B-14 lists the Oracle Database invalid record event attributes.

Table B-14 Oracle Database Invalid Record Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`ENDUSER` | `NUMBER`
`ERROR_MESSAGE` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`MODULE_NAME` | `VARCHAR2(100)`
`OBJECT_ID` | `NUMBER`
`ORIGINAL_CONTENT1` | `VARCHAR2(4000)`
`ORIGINAL_CONTENT2` | `VARCHAR2(4000)`
`ORIGINAL_CONTENT3` | `VARCHAR2(4000)`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SEVERITY` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.9 Object Management Events

Object management events track audited actions performed on database objects, such as `CREATE TABLE` statements. The Object Management Report, described in Section 3.4.3, uses these events.

Table B-15 lists the Oracle Database object management events and event IDs.

Table B-15 Oracle Database Object Management Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER DIMENSION` | `175`
`ALTER INDEX` | `11`
`ALTER MATERIALIZED VIEW` | `75`
`ALTER MATERIALIZED VIEW LOG` | `72`
`ALTER OPERATOR` | `183`
`ALTER OUTLINE` | `179`
`ALTER SEQUENCE` | `14`
`ALTER TABLE` | `15`
`CREATE DIMENSION` | `174`
`CREATE DIRECTORY` | `157`
`CREATE INDEX` | `9`
`CREATE MATERIALIZED VIEW` | `74`
`CREATE MATERIALIZED VIEW LOG` | `71`
`CREATE OUTLINE` | `180`
`CREATE PUBLIC DATABASE LINK` | `112`
`CREATE PUBLIC SYNONYM` | `110`
`CREATE SCHEMA` | `56`
`CREATE SEQUENCE` | `13`
`CREATE SYNONYM` | `19`
`CREATE TABLE` | `1`
`CREATE VIEW` | `21`
`DROP DIMENSION` | `176`
`DROP DIRECTORY` | `158`
`DROP INDEX` | `10`
`DROP MATERIALIZED VIEW` | `76`
`DROP MATERIALIZED VIEW LOG` | `73`
`DROP OUTLINE` | `181`
`DROP PUBLIC DATABASE LINK` | `113`
`DROP PUBLIC SYNONYM` | `111`
`DROP SEQUENCE` | `16`
`DROP SYNONYM` | `20`
`DROP TABLE` | `12`
`DROP VIEW` | `22`
`FLASHBACK TABLE` | `205`
`LOCK` | `26`
`PURGE INDEX` | `201`
`PURGE TABLE` | `200`
`RENAME` | `28`
`UNDROP OBJECT` | `202`
`UPDATE INDEXES` | `182`
`VALIDATE INDEX` | `23`

Table B-16 lists the Oracle Database object management event attributes.

Table B-16 Oracle Database Object Management Event Attributes

Attribute Name | Data Type
--- | ---
`ASSOCIATED_OBJECT_NAME` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER` | `VARCHAR2(4000)`
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`NEW_OBJECT_NAME` | `VARCHAR2(4000)`
`NEW_OBJECT_OWNER` | `VARCHAR2(4000)`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.10 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.4, uses these events.

Table B-17 lists the Oracle Database peer association events and event IDs.

Table B-17 Oracle Database Peer Association Events and Event IDs

Event Name | Event ID
--- | ---
`CREATE DATABASE LINK` | `32`
`DROP DATABASE LINK` | `33`

Table B-18 lists the Oracle Database peer association event attributes.

Table B-18 Oracle Database Peer Association Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD`# | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

## B.11 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such creating of roles and privileges. The Role and Privilege Management Report, described in Section 3.4.5, uses these events.

Table B-19 lists the Oracle Database role and privilege management events and event IDs.

Table B-19 Oracle Database Role and Privilege Management Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER ROLE` | `79`
`CREATE ROLE` | `52`
`DROP ROLE` | `54`
`GRANT OBJECT` | `17`
`GRANT ROLE` | `114`
`REVOKE OBJECT` | `18`
`REVOKE ROLE` | `115`

Table B-20 lists the Oracle Database role and privilege management event attributes.

Table B-20 Oracle Database Role and Privilege Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADMIN_OPTION` | `NUMBER`
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME`
`GRANTEE` | `VARCHAR2(4000)`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OBJECT_PRIVILEGE` | `VARCHAR2(255)`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`ROLE_NAME` | `VARCHAR2(4000)`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`SYSTEM_PRIVILEGE` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.12 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of PL/SQL procedures or functions. The Procedure Executions Report, described in Section 3.3.5, uses these events.

Table B-21 lists the Oracle Database service and application utilization events and event IDs.

Table B-21 Oracle Database Service and Application Utilization Events and Event IDs

Event Name | Event ID
--- | ---
`CALL METHOD` | `170`
`EXECUTE PROCEDURE` | `116`
`PL/SQL EXECUTE` | `47`

Table B-22 lists the Oracle Database service and application utilization event attributes.

Table B-22 Oracle Database Service and Application Utilization Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.13 System Management Events

System management events track audited system management activity, such as `STARTUP` and `SHUTDOWN` operations. The System Management Report, described in Section 3.4.6, uses these events.

Table B-23 lists the Oracle Database system management events and event IDs.

Table B-23 Oracle Database System Management Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER CLUSTER` | `5`
`ALTER DATABASE` | `35`
`ALTER ROLLBACK SEG` | `37`
`ALTER SYSTEM` | `49`
`ALTER TABLESPACE` | `40`
`ANALYZE CLUSTER` | `64`
`CREATE CLUSTER` | `4`
`CREATE CONTROL FILE` | `57`
`CREATE DATABASE` | `34`
`CREATE ROLLBACK SEG` | `36`
`CREATE TABLESPACE` | `39`
`DISABLE ALL TRIGGERS` | `121`
`DROP CLUSTER` | `8`
`DROP ROLLBACK SEG` | `38`
`DROP TABLESPACE` | `41`
`ENABLE ALL TRIGGERS` | `120`
`FLASHBACK` | `128`
`FLASHBACK DATABASE` | `204`
`PURGE DBA_RECYCLEBIN` | `198`
`PURGE TABLESPACE` | `199`
`SHUTDOWN` | `216`
`STARTUP` | `215`
`SUPER USER DDL` | `213`
`SUPER USER DML` | `214`
`SYSTEM GRANT` | `108`
`SYSTEM REVOKE` | `109`
`TRUNCATE CLUSTER` | `86`

Table B-24 lists the Oracle Database system management event attributes.

Table B-24 Oracle Database System Management Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.14 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as `ALTER SUMMARY` statements. The Uncategorized Activity Report, described in Section 3.5.3, uses these events.

Table B-25 lists the Oracle Database unknown or uncategorized events and event IDs.

Table B-25 Oracle Database Unknown or Uncategorized Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER SUMMARY` | `172`
`COMMENT` | `29`
`CREATE SUMMARY` | `171`
`DROP SUMMARY` | `173`
`NO-OP` | `27`
`SUPER USER UNKNOWN` | `217`
`UNKNOWN` | `0`
`USER COMMENT` | `117`

Table B-26 lists the Oracle Database unknown or uncategorized event attributes.

Table B-26 Unknown or Uncategorized Event Attributes

Attribute Name | Data Type
--- | ---
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.

## B.15 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.6, uses these events.

Table B-27 lists the Oracle Database user session events and event IDs.

Table B-27 Oracle Database User Session Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER SESSION` | `42`
`COMMIT` | `44`
`CREATE RESTORE POINT` | `206`
`CREATE SESSION` | `129`
`DROP RESTORE POINT` | `207`
`LOGOFF` | `101`
`LOGOFF BY CLEANUP` | `102`
`LOGON` | `100`
`PROXY AUTHENTICATION ONLY` | `208`
`PURGE USER_RECYCLEBIN` | `197`
`ROLLBACK` | `45`
`SAVEPOINT` | `46`
`SESSION REC` | `103`
`SET ROLE` | `55`
`SET TRANSACTION` | `48`
`SUPER USER LOGON` | `212`

Table B-28 lists the Oracle Database user session event attributes.

Table B-28 Oracle Database User Session Event Attributes

Attribute Name | Data Type
--- | ---
`AUTHENTICATION_METHOD` | `VARCHAR2(255)`
`CLIENT_APPINFO` | `VARCHAR2(4000)`
`CLIENT_ID` | `VARCHAR2(4000)`
`COMMENT_TEXT` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`INSTANCE_NUMBER` | `NUMBER`
`LOGOFF_DLOCK` | `NUMBER`
`LOGOFF_LREAD` | `NUMBER`
`LOGOFF_LWRITE` | `NUMBER`
`LOGOFF_PREAD` | `NUMBER`
`OBJECT_ID` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`PROXY_SESSIONID` | `NUMBER`
`SCN` | `NUMBER`
`SESSION_ACTIONS` | `VARCHAR2(255)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SQL_BIND` Foot 1 | `VARCHAR2(4000)`
`SQL_TEXT` Foot 2 | `VARCHAR2(4000)`
`STATEMENTID` | `NUMBER`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`UNDO_SQL_TEXT` | `VARCHAR2(4000)`
`USER_GUID` | `VARCHAR2(32)`
`USERNAME` | `VARCHAR2(4000)`

Footnote 1 `SQL_BIND` variable could be truncated to 4000 characters.

Footnote 2 `SQL_TEXT` variable could be truncated to 4000 characters.