SAP Knowledge Base Article - Preview

2441754 - Why are there so many rows in table sysaudits_nn although the corresponding login has auditing disabled?

Symptom

There are so many rows with event 37 in system table sysaudits_nn although the login has auditing disabled.
This issue only happens on ASE157 and ASE 16.

For example:

  • There are so many rows in sysaudits:-

        select * from sybsecurity..sysaudits_02 where eventtime > '21 Feb 2017 13:30' and loginname = 'test_user'
     event  eventmod spid   eventtime                       sequence suid        dbid   objid       xactid         loginname                      dbname                         objname                                                                                                                                                                                                                                                         objowner                       extrainfo                                                                                                                                                                                                                                                       nodeid
     ------ -------- ------ ------------------------------- -------- ----------- ------ ----------- -------------- ------------------------------ ------------------------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------
         37        2   1905             Feb 21 2017  1:33PM        1           0      1        NULL NULL           test_user                      master                         NULL                                                                                                                                                                                                                                                            NULL                           ; ; ; ; 2401.11.2; ; ;                                                                                                                                                                                                                                            NULL
         37        2    153             Feb 21 2017  1:35PM        1           0      1        NULL NULL           test_user                      master                         NULL                                                                                                                                                                                                                                                            NULL                           ; ; ; ; 2401.11.2; ; ;                                                                                                                                                                                                                                            NULL
         37        2    522             Feb 21 2017  1:40PM        1           0      1        NULL NULL           test_user                      master                         NULL                                                                                                                                                                                                                                                            NULL                           ; ; ; ; 2401.11.2; ; ;                                                                                                                                                                                                                                            NULL
         37        2   2485             Feb 21 2017  1:41PM        1           0      1        NULL NULL           test_user                      master                         NULL                                                                                                                                                                                                                                                            NULL                           ; ; ; ; 2401.11.2; ; ;                                                                                                                                                                                                                                            NULL
  • The login 'test_user' doesn't has auditing enabled, but sso_role has auditing enabled:-

1> sp_displayaudit
2> go
No sprocs/triggers currently have auditing enabled.
...omit...
No logins currently have auditing enabled.
No databases currently have auditing enabled.
Option Name Value
------------------------------ ------------------------------
adhoc off
...omit...
sso_role on
...omit...
webservices_role off

(1 row affected)
(return status = 0)



Read more...

Environment

  • SAP Adaptive Server Enterprise (ASE) 16.0 and higher
  • SAP Adaptive Server Enterprise (ASE) 15.7 and higher

Product

SAP Adaptive Server Enterprise 15.7 ; SAP Adaptive Server Enterprise 16.0

Keywords

KBA , BC-SYB-ASE , Sybase ASE Database Platform (non Business Suite) , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.