Find IP address of machine for an executing query - Oracle 11g only

-- Find IP address of machine to audit in Oracle
-- i.e., who is executing queries manually ( except web / app session)
-- Applicable to Oracle 11g and above in any OS platform

Step:1: Collect port number from gv$session for the particular session
--------------------------------------------------------------------------------------------
sql> SELECT username, seconds_in_wait, machine, port, terminal, 
program, module, service_name
FROM v$session WHERE type = 'USER' 
and program in ('plsqldev.exe','sqlservr.exe','toad.exe');

Note: You can use other .exe programs if any other tool / program to trace.

Step:2 : Use port number in below query in ssh / telnet session

Example: Linux based X series servers

$ netstat -an | grep 28143

output:

bash-3.2$ netstat -an | grep 28143
tcp4       0      0  10.44.8.10.1521        172.16.59.137.28143    ESTABLISHED

Example:2 -- In AIX based power servers

bash-3.2$ netstat -an|grep 19433
tcp4       0      0  10.44.8.11.1521        10.44.8.18.19433       ESTABLISHED
udp4       0      0  169.254.162.39.19433   *.*  


Hope the above method will help to take advantage to find the issue creating user.