Oracle : Why dba_audit_trail shows more logoff than logon

Some of you guys might be puzzled why there are more logoff then logon from the dba_audit_trail.

That is because each logon is turned into a logoff upon logoff.

looking at the full record.

when you have a logon event, it looks like this:

-----------------
OS_USERNAME : "tkyte"
USERNAME : "OPS$TKYTE"
USERHOST : ""
TERMINAL : ""
TIMESTAMP : "28-jul-2005 09:10:33"
ACTION_NAME : "LOGON"
LOGOFF_TIME : ""
LOGOFF_LREAD : ""
LOGOFF_PREAD : ""
LOGOFF_LWRITE : ""
LOGOFF_DLOCK : ""
SESSIONID : "5942"
RETURNCODE : "0"
CLIENT_ID : ""
SESSION_CPU : ""


when that logs off -- it updates it to this:

OS_USERNAME : "tkyte"
USERNAME : "OPS$TKYTE"
USERHOST : ""
TERMINAL : ""
TIMESTAMP : "28-jul-2005 09:10:33"
ACTION_NAME : "LOGOFF"
LOGOFF_TIME : "28-jul-2005 09:12:10"
LOGOFF_LREAD : "2738"
LOGOFF_PREAD : "278"
LOGOFF_LWRITE : "18"
LOGOFF_DLOCK : "0"
SESSIONID : "5942"
RETURNCODE : "0"
CLIENT_ID : ""
SESSION_CPU : "26"


You have the logon logoff times tracked for you already.


Source : http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:1830073957439