监听日志

查看监听日志就行了

监听日志只能看到访问的IP，看不到登录的哪个用户

开启审计后 通过 dba_fga_audit_trail 表进行查看

把这个放触发器里面，你想要啥都有~~~~~

SELECT SYS_CONTEXT (‘USERENV’, ‘TERMINAL’) terminal,
SYS_CONTEXT (‘USERENV’, ‘LANGUAGE’) language,
SYS_CONTEXT (‘USERENV’, ‘SESSIONID’) sessionid,
SYS_CONTEXT (‘USERENV’, ‘INSTANCE’) instance,
SYS_CONTEXT (‘USERENV’, ‘ENTRYID’) entryid,
SYS_CONTEXT (‘USERENV’, ‘ISDBA’) isdba,
SYS_CONTEXT (‘USERENV’, ‘NLS_TERRITORY’) nls_territory,
SYS_CONTEXT (‘USERENV’, ‘NLS_CURRENCY’) nls_currency,
SYS_CONTEXT (‘USERENV’, ‘NLS_CALENDAR’) nls_calendar,
SYS_CONTEXT (‘USERENV’, ‘NLS_DATE_FORMAT’) nls_date_format,
SYS_CONTEXT (‘USERENV’, ‘NLS_DATE_LANGUAGE’) nls_date_language,
SYS_CONTEXT (‘USERENV’, ‘NLS_SORT’) nls_sort,
SYS_CONTEXT (‘USERENV’, ‘CURRENT_USER’) current_user,
SYS_CONTEXT (‘USERENV’, ‘CURRENT_USERID’) current_userid,
SYS_CONTEXT (‘USERENV’, ‘SESSION_USER’) session_user,
SYS_CONTEXT (‘USERENV’, ‘SESSION_USERID’) session_userid,
SYS_CONTEXT (‘USERENV’, ‘PROXY_USER’) proxy_user,
SYS_CONTEXT (‘USERENV’, ‘PROXY_USERID’) proxy_userid,
SYS_CONTEXT (‘USERENV’, ‘DB_DOMAIN’) db_domain,
SYS_CONTEXT (‘USERENV’, ‘DB_NAME’) db_name,
SYS_CONTEXT (‘USERENV’, ‘HOST’) HOST,
SYS_CONTEXT (‘USERENV’, ‘OS_USER’) os_user,
SYS_CONTEXT (‘USERENV’, ‘EXTERNAL_NAME’) external_name,
SYS_CONTEXT (‘USERENV’, ‘IP_ADDRESS’) ip_address,
SYS_CONTEXT (‘USERENV’, ‘NETWORK_PROTOCOL’) network_protocol,
SYS_CONTEXT (‘USERENV’, ‘BG_JOB_ID’) bg_job_id,
SYS_CONTEXT (‘USERENV’, ‘FG_JOB_ID’) fg_job_id,
SYS_CONTEXT (‘USERENV’, ‘AUTHENTICATION_TYPE’) authentication_type,
SYS_CONTEXT (‘USERENV’, ‘AUTHENTICATION_DATA’) authentication_data
FROM DUAL;

主要就是想不通过触发器的方法来获取地址和用户，
能否通过v$session的sid从操作系统层面获取ip呢

用sid去找spid还可以，然后通过spid去找IP这个估计实现不了…