Anyway to find out who shutdown oracle database

oracle

In my oracle database alert log file, I saw someone issued the command to shutdown oracle database. I am not able to find out what caused this. Is there a way to find out which user/program that issued the command?

Fri Feb 1 22:30:35 2013
Completed: alter database close
Fri Feb 1 22:30:35 2013
alter database dismount
Completed: alter database dismount

Best Answer

The details should be available in audit files located by default in $ORACLE_BASE/admin/$ORACLE_SID/adump -directory or wherever your AUDIT_FILE_DEST-parameter points them to.

Look for more information for example from here: http://docs.oracle.com/cd/B28359_01/network.111/b28531/auditing.htm#CEGJADDC