[OAUGNetDBA]-SYSADMIN account logon audit

[NV <nvora76@gmail.com>]

Hi,

We have a SOX control where they want us to change SYSADMIN account
password on regular basis and then monitor access to this account to
make sure that no one uses this account instead of using named
accounts. We are auditing the logins with standard Sigon Audit User
report.

The problem is I am the only person who knows this password and I have
not used that account, but the audit report shows this account being
used at random times. Does anyone have any idea as to how to
audit/trace back to who may have used this account? I believe that
there are concurrent requests or other system activities (may be OAM)
that may be using this, but auditors are asking me to prove that the
account is not being used by someone other than me.

If anyone else has experienced this any insight is appreciated.

Thanks,
Neel

#############################################################
This message is sent to you because you are subscribed to the mailing list <OAUGNetDBA@oaug.com>.
To unsubscribe, E-mail to: <OAUGNetDBA-off@oaug.com>
To switch to the FEED mode, send any message to <OAUGNetDBA-feed@oaug.com>
To switch to the DIGEST mode, E-mail to <OAUGNetDBA-digest@oaug.com>
To switch to the INDEX mode, E-mail to <OAUGNetDBA-index@oaug.com>
Send administrative queries to  <OAUGNetDBA-request@oaug.com>