Find audit information about dropped users
NOTE :
“DROP USER” is audited by default from Oracle 12c onwards.
Use the below query to take information if you have not turned off standard auditing
QUERY :
select os_username,username,userhost,timestamp,obj_name,action_name,priv_used
from dba_audit_trail
where action_name=’DROP USER’
and to_char(cast ( timestamp as date),’dd.mm.yyyy’) > ‘13.11.2019’
AND OBJ_NAME IN (‘JIM’,’DWIGHT’)
order by timestamp desc;
Recent Posts
