Introduction to Auditing

What Is Auditing?

Auditing is the monitoring and recording of configured database actions, from both database users and nondatabase users^Foot 1 . You can base auditing on individual actions, such as the type of SQL statement executed, or on combinations of data that can include the user name, application, time, and so on. You can configure auditing for both successful and failed activities, and include or exclude specific users from the audit. In a multitenant environment, you can audit individual actions of the pluggable database (PDB) or individual actions in the entire multitenant container database (CDB). In addition to auditing the standard activities the database provides, auditing can include activities from Oracle Database Real Application Security, Oracle Recovery Manager, Oracle Data Pump, Oracle Data Mining, Oracle Database Vault, Oracle Label Security, and Oracle SQL*Loader direct path events. Auditing is enabled by default. All audit records are written to the unified audit trail in a uniform format and are made available through the UNIFIED_AUDIT_TRAIL view. These records reside in the AUDSYSschema. The audit records are stored in the SYSAUX tablespace by default. Oracle recommends that you configure a different tablespace for the unified audit trail. For example, you can create a tablespace called SYSAUD with pre-created sized (1 GB) extents for the audit trail tables. To set the new audit trail location, use the DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION procedure.

See more information about this procedure- More information