Oracle Audit: Why Logons are less than 0.1% of logoffs?

I see the following quantities of logins versus logoffs vs logoffs by cleanup in a database:

SQL> select action_name, count(*) qty
from Dba_audit_session
group by action_name
order by 1;  2    3    4

ACTION_NAME                        QTY
--------------------------- ----------
LOGOFF                         1946180
LOGOFF BY CLEANUP               754683
LOGON                             1026

It doesn't make sense that logons are less than 0.1% of logoffs.

Any ideas why?

It may depend on whether you are using connection pooling or not.

Also, do you realize LOGON and LOGOFF for a session are recorded in the same audit row? So here the LOGON is showing how many are still logged in right now.

Consider the following scenario.

SQL> select ACTION_NAME, username, count(*) from dba_audit_session group by action_name, username;

When you run this first time it shows LOGON 1.

Without logging off, try to connect as the same user as you have connected before.

SQL> select ACTION_NAME, username, count(*) from dba_audit_session group by action_name, username;

Now, it shows LOGON 1 and LOGOFF 1.

SQL> select ACTION_NAME, username, count(*) from dba_audit_session group by action_name, username;

Now, it shows LOGON 1 and LOGOFF 2.

Each time you are seeing the 1 currently logged in session as 'LOGON', and the (increasing) number of completed sessions as 'LOGOFF'.

StackExchange Database Administrators Q#111644, answer score: 4