Had to do a couple of reports from orasso.wwsso_audit_log_table$ the other day and decided to record the syntax here for posterity.
[me@test tmp]$ sqlplus ORASSO/12345@infra SQL*Plus: Release 126.96.36.199.0 Production on Fri Apr 20 11:01:09 2012 Copyright (c) 1982, 2011, Oracle. All rights reserved. Connected to: * * * SQL> spool report.html; SQL> set markup html on; SQL> select USER_NAME,ACTION,MESSAGE, 2 to_char(LOG_DATE,'yyyy.mm.dd hh24:mi:ss') 3 from ORASSO.WWSSO_AUDIT_LOG_TABLE$ 4 where USER_NAME = 'L123456';
This makes for a simple 4 column report giving the user’s ID, the action taken (usually “LOGIN”), the message returned (like “Login Failed” or “Login Unsuccessful”) and the date and time, down to the second, of the event.
If your network topography allows you to see the real IP address of incoming clients you could also add “IP_ADDRESS” for that data element.