We have observed that AUDIT for ALTER session is also enabled on HRMS DB which is

creating huge record in AUD$ which is not required as per AUDIT.

Found one note in which it is mentioned that Audit for alter session get enabled by
default when DB is upgraded from 11g to 12c.

Rapid growth of AUD$ because ALTER SESSIONS being audited for all users (Doc ID
2408610.1)

***********************************************************************************
**************************

1. DB is upgraded from 11g to 12c --- Yes

2. DB Audit is set to any value other than NONE

SQL> SELECT name, value FROM v$system_parameter WHERE name = 'audit_trail';

NAME
---------------------
VALUE
---------------------------
audit_trail
DB, EXTENDED

3. Unified Auditing is disabled

SQL> SELECT parameter, value FROM v$option WHERE parameter = 'Unified Auditing';

PARAMETER VALUE
----------------------------------------------------------------
----------------------------------------------------------------
Unified Auditing FALSE

4. Database Vault is enabled --- DISABLED

SQL> SELECT inst_id, parameter, value FROM gV$OPTION WHERE PARAMETER = 'Oracle
Database Vault';

INST_ID PARAMETER VALUE

---------- ----------------------------------------------------------------
----------------------------------------------------------------
1 Oracle Database Vault FALSE
2 Oracle Database Vault FALSE

5. ALTER SESSION being audited for all Users

SQL> col USER_NAME for a15

SQL> col PROXY_NAME for a15
SQL> col AUDIT_OPTION for a15
SQL> col SUCCESS for a30
SQL> col FAILURE for a30
SQL> SELECT * FROM DBA_STMT_AUDIT_OPTS WHERE audit_option = 'ALTER SESSION' AND
USER_NAME IS NULL;
USER_NAME PROXY_NAME AUDIT_OPTION SUCCESS
FAILURE
--------------- --------------- --------------- ------------------------------
------------------------------
ALTER SESSION BY ACCESS BY
ACCESS

6. A lot of ALTER SESSION are being audited on daily basis (results will look
similar to)

SELECT dbms_lob.substr(sqltext,100,1), COUNT(1) FROM sys.aud$ WHERE NTIMESTAMP# >

sysdate - 1 GROUP BY dbms_lob.substr(sqltext,100,1) ORDER BY 2 DESC;

SQL> col dbms_lob.substr(sqltext,100,1) for a88

SQL> SELECT dbms_lob.substr(sqltext,100,1), COUNT(1) FROM sys.aud$ WHERE
NTIMESTAMP# > sysdate - 1 GROUP BY dbms_lob.substr(sqltext,100,1) ORDER BY 2 DESC;

DBMS_LOB.SUBSTR(SQLTEXT,100,1)
COUNT(1)
-----------------------------------------------------------------------------------
----- ----------
alter session set NLS_TIMESTAMP_TZ_FORMAT = 'YYYY-MM-DD-HH24.MI.SS.FF'
435968
alter session set NLS_DATE_FORMAT = 'YYYY-MM-DD'
435968
alter session set NLS_TIMESTAMP_FORMAT = 'YYYY-MM-DD-HH24.MI.SS.FF'
435968
ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '.,'
435968

4201
ALTER SESSION SET NLS_LANGUAGE= 'AMERICAN' NLS_TERRITORY= 'AMERICA' NLS_CURRENCY=
'$' NL 1140
S_ISO_CURREN

ALTER SESSION SET TIME_ZONE='+05:30'

696
SELECT TO_CHAR(current_timestamp AT TIME ZONE 'GMT', 'YYYY-MM-DD HH24:MI:SS TZD')
AS cu 666
rr_timestamp

522
select 'INTER_MEDIA' as name, decode((select username from dba_users where
username='ORD
SYS'), 'ORD

SELECT 1 FROM WMSYS.USER_WORKSPACES WHERE WORKSPACE = :B1

338
alter session enable parallel dml
221
alter session disable parallel dml
221
ALTER SESSION SET TIME_ZONE='Asia/Calcutta' NLS_LANGUAGE='AMERICAN'
NLS_TERRITORY='AMERI 145
CA'

select value
143
from wmsys.wm_installation
where name = 'OWM_VERSION'

TRUNCATE TABLE sysadm.PS_NIA_ALWD3_TMP5

120
TRUNCATE TABLE sysadm.PS_NIA_ALWD2_TMP5
120
TRUNCATE TABLE sysadm.PS_NIA_ALWD1_TMP5
120
TRUNCATE TABLE sysadm.PS_NIA_ALWD0_TMP5
120
ALTER SESSION SET TIME_ZONE='Asia/Kolkata' NLS_LANGUAGE='AMERICAN'
NLS_TERRITORY='AMERIC 101
A'

99
SELECT
ts.tablespace_name,
NVL(t.bytes/1024/1024,0) allocated_space,
NVL(DECODE(un.bytes,null,DECOD

SELECT SCN_PER_SEC, ROUND(AVG_SCN_PER_SEC,2), TO_CHAR(TIME_STAMP, 'YYYY-MM-DD

HH24:MI:SS 90
') FROM (SEL

ALTER SESSION SET NLS_DATE_LANGUAGE = 'AMERICAN'

76
ALTER SESSION SET NLS_DATE_FORMAT='DD-MON-YYYY'
76
with
70
vpd_status as (
select (case when (SELECT count(*) as vpd_total_policy_count FROM SYS.DBA_POLIC

select a.tablespace_name,a.meg, a.maxmeg,a.file_name,a.file_id,a.ts#,

a.blocksize,a.flag 36
, b.fre

TRUNCATE TABLE sysadm.PS_NIA_ALWD0_TMP6

34
TRUNCATE TABLE sysadm.PS_NIA_ALWD1_TMP6
34
TRUNCATE TABLE sysadm.PS_NIA_ALWD2_TMP6
34
TRUNCATE TABLE sysadm.PS_NIA_ALWD3_TMP6
34
TRUNCATE TABLE sysadm.PS_NIA_BALRPTMP04
31
TRUNCATE TABLE sysadm.PS_NIA_BALRP_EMP4
31
TRUNCATE TABLE sysadm.PS_NIA_BALRPTMP24
31
TRUNCATE TABLE sysadm.PS_NIA_BALRPTMP14
31
TRUNCATE TABLE sysadm.PS_NIA_PR_S1_TMP4
30
TRUNCATE TABLE sysadm.PS_NIA_PR_SS_TMP4
30
TRUNCATE TABLE sysadm.PS_NIA_PR_SC_TMP4
30

27
SELECT /*+ all_rows */ u.name owner, count(1) invalid_count
FROM sys."_CURRENT_EDITION_OBJ" o, sys.

TRUNCATE TABLE sysadm.PS_GPIN_NPRJ_TMP8

26
TRUNCATE TABLE sysadm.PS_NIA_APGP2_TMP4
24
TRUNCATE TABLE sysadm.PS_NIA_APGP3_TMP4
24
TRUNCATE TABLE sysadm.PS_NIA_APGP_TMP4
24
TRUNCATE TABLE sysadm.PS_NIA_DEDF_TAO5
24
TRUNCATE TABLE sysadm.PS_NIA_PR_DN_TAO4
24
TRUNCATE TABLE sysadm.PS_NIA_PR_D2_TAO5
24
TRUNCATE TABLE sysadm.PS_NIA_PR_D3_TAO5
24
TRUNCATE TABLE sysadm.PS_NIA_PR_D4_TAO5
24
TRUNCATE TABLE sysadm.PS_NIA_PR_DD_TAO5
24
TRUNCATE TABLE sysadm.PS_NIA_PR_D1_TAO5
24
TRUNCATE TABLE sysadm.PS_SJTPRJ_TMP
22
TRUNCATE TABLE sysadm.PS_HRS_SJTJO_TMP
20
TRUNCATE TABLE sysadm.PS_NIA_ALC1_TMP4
20
TRUNCATE TABLE sysadm.PS_NIA_ALC2_TMP4
20
TRUNCATE TABLE sysadm.PS_NIA_ALW_TMP4
20
TRUNCATE TABLE sysadm.PS_NIA_ALC4_TMP4
20
TRUNCATE TABLE sysadm.PS_NIA_ALC_TMP4
20
TRUNCATE TABLE sysadm.PS_NIA_ALC3_TMP4
20
SELECT TO_CHAR(TO_TIMESTAMP('2019-08-09' , 'YYYY-MM-DD') AT TIME ZONE 'GMT',
'YYYY-MM-D 18
D HH24:MI:SS

SELECT TO_CHAR(TO_TIMESTAMP('2019-08-08' , 'YYYY-MM-DD') AT TIME ZONE 'GMT',

'YYYY-MM-D 18
D HH24:MI:SS

ALTER SESSION SET TIME_ZONE='+5:30' NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA'

14
TRUNCATE TABLE sysadm.PS_GPIN_IT_EE_DTL
14
TRUNCATE TABLE sysadm.PS_GPIN_ERVL_TMP
14
TRUNCATE TABLE sysadm.PS_GPIN_ACC_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_ACC_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_ACVL_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_ACVL_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_SEVL_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_ERN_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_SEL_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_SEL_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_SEVL_TMP8
13
TRUNCATE TABLE sysadm.PS_GPIN_ERN_TMP8
13
truncate table ps_NIA_PR_LICD_TBL
11
TRUNCATE TABLE sysadm.PS_NIA_ALWD0_TMP7
10
TRUNCATE TABLE sysadm.PS_NIA_ALWD3_TMP7
10
TRUNCATE TABLE sysadm.PS_NIA_ALWD2_TMP7
10
TRUNCATE TABLE sysadm.PS_NIA_ALWD1_TMP7
10
TRUNCATE TABLE sysadm.PS_NIA_APGP2_TMP5
8
TRUNCATE TABLE sysadm.PS_NIA_APGP3_TMP5
8
TRUNCATE TABLE sysadm.PS_SJTPRJUSF_TMP
8
TRUNCATE TABLE sysadm.PS_NIA_PR_LICR_STG
8
TRUNCATE TABLE sysadm.PS_NIA_APGP_TMP5
8
TRUNCATE TABLE sysadm.PS_NIA_PR_S1_TMP5
6
TRUNCATE TABLE sysadm.PS_NIA_PR_SC_TMP5
6
alter session set nls_sort = binary
6
TRUNCATE TABLE sysadm.PS_SJTPRJ2_TMP
6
TRUNCATE TABLE sysadm.PS_NIA_PR_SS_TMP5
6
TRUNCATE TABLE sysadm.PS_GP_GL_AMT1TMP4
5
TRUNCATE TABLE sysadm.PS_GP_GL_AMT2TMP4
5
TRUNCATE TABLE sysadm.PS_GP_GL_DATATMP4
5
TRUNCATE TABLE sysadm.PS_GP_GL_DNFTMP4
5
alter session set "_optimizer_adaptive_cursor_sharing"=false
5
TRUNCATE TABLE sysadm.PS_GP_GL_SEGTMP4
5
TRUNCATE TABLE sysadm.PS_GP_GL_SEGVTMP4
5
TRUNCATE TABLE sysadm.PS_GP_GL_STO6TMP4
5
TRUNCATE TABLE sysadm.PS_NIA_GPRPTTMP5
5
TRUNCATE TABLE sysadm.PS_GP_GL_S7N8TMP4
5
ALTER SESSION SET NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA' NLS_CURRENCY='$'
NLS_I 4
SO_CURRENCY=

SELECT SCN_PER_SEC, ROUND(AVG_SCN_PER_SEC,2), TIME_STAMP FROM (SELECT * FROM

( SELECT TI 4
ME_STAMP, SC

TRUNCATE TABLE sysadm.PS_GPS_PM_SJT_TMP

4
TRUNCATE TABLE sysadm.PS_NIA_NEGSAL0_STG
4
TRUNCATE TABLE sysadm.PS_NIA_NEGSAL1_STG
4
Truncate table PS_NIA_WORKDAT_TBL
4
TRUNCATE TABLE sysadm.PS_NIA_NETS1_TMP4
4
TRUNCATE TABLE sysadm.PS_NIA_NETS2_TMP4
4
TRUNCATE TABLE sysadm.PS_NIA_NETS3_TMP4
4
TRUNCATE TABLE sysadm.PS_SJT_DEPT_TMP
4
TRUNCATE TABLE sysadm.PS_SJT_OPR_CLS_TMP
4
TRUNCATE TABLE sysadm.PS_NIA_NEGSAL2_STG
4
TRUNCATE TABLE PS_NIA_PF_DATE_TMP
3
TRUNCATE TABLE sysadm.PS_GPIN_NPRJ_TMP9
2
truncate table checklist_automation_node2
2
TRUNCATE TABLE sysadm.PS_NIA_NETS1_TMP6
2
TRUNCATE TABLE sysadm.PS_NIA_NETS2_TMP5
2
TRUNCATE TABLE sysadm.PS_NIA_NETS2_TMP6
2
TRUNCATE TABLE sysadm.PS_NIA_NETS3_TMP5
2
TRUNCATE TABLE sysadm.PS_NIA_NETS3_TMP6
2
TRUNCATE TABLE sysadm.PS_NIA_PR_MBS1_STG
2
TRUNCATE TABLE sysadm.PS_NIA_PR_MBS_STG
2
TRUNCATE TABLE sysadm.PS_SJT_CLS_TMP
2
TRUNCATE TABLE sysadm.PS_SJT_OPR_CLS
2
alter session set nls_date_format='DD-MON-YYYY HH24:MI:SS'
2
alter session set nls_date_format='mm/dd/yyyy hh24:mi:ss'
2
alter session set plscope_settings = 'identifiers:none'
2
alter session set plsql_code_type = interpreted
2
alter session set plsql_optimize_level = 2
2
select os_username, username, userhost, to_char(timestamp,'mm/dd/yyyy hh24:mi:ss')
times 2
tamp,
return

truncate table checklist_automation_node1

2
TRUNCATE TABLE sysadm.PS_NIA_NETS1_TMP5
2
SELECT MIN(TIME_DP) FROM SYS.SMON_SCN_TIME WHERE TIME_DP>
SYS_EXTRACT_UTC(SYSTIMESTAMP)- 1
1

TRUNCATE TABLE PS_NIA_PR_BANK_TBL

1
TRUNCATE TABLE sysadm.PS_GPIN_ACC_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_ACC_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_ACVL_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_ACVL_TMP9
1
truncate table TABLESPACE_THRESHOLD_COMPARE
1
TRUNCATE TABLE sysadm.PS_GPIN_ERN_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_SEL_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_SEL_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_SEVL_TMP9
1
TRUNCATE TABLE sysadm.PS_GPIN_SEVL_TMP9
1
alter session set current_schema=sysadm
1
TRUNCATE TABLE sysadm.PS_GPIN_ERN_TMP9
1

142 rows selected.

***********************************************************************************
******************************************