Abstract: In order to resolve the problem unable to obtain the SQL operations of user in audit log of Oracle 8i/9i，an approach of tracing SQL of user’s session in Oracle database is proposed in this paper，which can recover the process of user’s session in Oracle 8i/9i database.In the approach，LogMiner is used to analyse the transaction log file for extracting some key fields，by matching the relate key fields in the audit log，the SQL of user’s session from his login to logout can be perfectly recovered.The result can be used to audit the operations and protect the security of Oracle database.

Key words: transaction log, audit log, LogMiner, session recover

摘要： 针对Oracle8i/9i系统自带的审计功能无法获取用户操作语句的问题，研究分析了Oracle数据库的事务日志文件，提出一种结合事务日志和审计日志还原用户访问数据库会话过程的方法。该方法使用LogMiner分析事务日志文件，通过匹配事务日志和审计日志中共有的关键字段，确定对应的数据库操作语句，从而还原出任意用户从登录到退出的完整会话过程。会话还原结果可用来执行数据库操作的审计，保护数据库安全。

关键词: 事务日志, 审计日志, LogMiner, 会话还原