for example, i need to monitor selects, updates and deletes to a specific table by a specific user. is there a simple way to do this seemingly straight forward task?
an example of a filter not working
event1 :
( Target Host Name = some_dev_db AND ( Device Host Name = some_dev_db AND Type != Correlation AND ( ( Name = delete [ignore case] AND Target User ID = user1 ) OR ( Name = alter [ignore case] AND Target User ID = user1 ) OR ( Name = select [ignore case] AND Target User ID = user1 ) OR ( Name = update [ignore case] AND Target User ID = user1 ) OR ( Name = insert [ignore case] AND Target User ID = user1 ) OR ( Name = delete [ignore case] AND Target User ID = user2 ) OR ( Name = alter [ignore case] AND Target User ID = user 2) OR ( Name = select [ignore case] AND Target User ID = user2 ) OR ( Name = update [ignore case] AND Target User ID = user2 ) OR ( Name = insert [ignore case] AND Target User ID = user2 ) OR ( Name = delete [ignore case] AND Target User ID = user3 ) OR ( Name = select [ignore case] AND Target User ID = user3 ) OR ( Name = alter [ignore case] AND Target User ID = user3 ) OR ( Name = update [ignore case] AND Target User ID = user3 ) OR ( Name = insert [ignore case] AND Target User ID = user3 ) OR ( Name = delete [ignore case] AND Target User ID = SYSTEM ) OR ( Name = select [ignore case] AND Target User ID = SYSTEM ) OR ( Name = alter [ignore case] AND Target User ID = SYSTEM ) OR ( Name = update [ignore case] AND Target User ID = SYSTEM ) OR ( Name = insert [ignore case] AND Target User ID = SYSTEM ) ) AND ( Device Vendor = Unix OR Device Vendor = ORACLE ) ) )
