If you consider going Unified Audit Trail in 12.1, please invest some time
to read How To Transfer Unified Audit Records To An Internal Relational
Table (Doc ID 2212196.1) and understand what's going on behind.
I did not have time to investigate all the details, But there is a reason
why Oracle changed Unified Audit Trail from 12.1 to 12.2 and provides this
backport.
hth
berx
2017-02-26 15:49 GMT+01:00 Franky Weber Faust <weber08weber@xxxxxxxxx>:
If you are running 12c you probably want to use Unified Audit Trail with
queued writes, which stores auditing records in memory first, then flushes
them persistently to disk:
SQL> EXEC DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_PROPERTY(-
DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,-
DBMS_AUDIT_MGMT.AUDIT_TRAIL_WRITE_MODE,-
DBMS_AUDIT_MGMT.AUDIT_TRAIL_QUEUED_WRITE);
Be aware that you might lose some auditing data if the instance crashes and
some records were not yet flushed to disk.
To enable Unified Auditing in Pure Mode check the necessary steps in the
documentation.
*Kind regards / Cordialmente / Saludos cordiales / Sincères amitiés / Mit
freundlichen Grüßen / Cordiali saluti,*
Franky Weber Faust
Oracle DBA
Skype: franky.faust
2017-02-24 11:53 GMT-03:00 Carlos Sierra <carlos.sierra.usa@xxxxxxxxx>:
there are some bugs and some notes on this area. i suggest you browse
MoS. You may want to start here:
https://support.oracle.com/epmos/faces/DocumentDisplay?id=1434614.1
https://support.oracle.com/epmos/faces/DocumentDisplay?id=2120366.1
https://support.oracle.com/epmos/faces/BugDisplay?id=20448588
On Feb 24, 2017, at 6:48 AM, Tim Gorman <tim.evdbt@xxxxxxxxx> wrote:
Balwanth,
That table is the one underlying views such as DBA_AUDIT_TRAIL, so high
INSERT volumes indicate that someone has used the AUDIT command to initiate
database auditing to a level which may be growing intrusive.
You may want to examine the DBA_AUDIT_TRAIL view and find what types of
auditing are being generated, and decide if it is necessary or not.
Be aware that people sometimes use the AUDIT command for temporary
debugging or troubleshooting purposes, and they may forget to NOAUDIT after
they find what they are seeking.
Good luck,
-Tim
On 2/24/17 07:26, Balwanth B wrote:
Query is
insert into sys.aud$( sessionid, entryid, statement, ntimestamp#, userid,
userhost, terminal, action#, returncode, logoff$lread, logoff$pread,
logoff$lwrite, logoff$dead, logoff$time, comment$text, spare1, clientid,
sessioncpu, proxy$sid, user$guid, instance#, process#, auditid, dbid)
values(:1, :2, :3, SYS_EXTRACT_UTC(SYSTIMESTAMP), :4, :5, :6, :7, :8, :9,
:10, :11, :12, cast(SYS_EXTRACT_UTC(systimestamp) as date), :13, :14,
:15, :16, :17, :18, :19, :20, :21, :22)
On Fri, Feb 24, 2017 at 9:24 AM, Balwanth B <balwanthdba@xxxxxxxxx>
wrote:
Hello everyone,
we are seeing high enq: HW – contention causing by SYS TABLE AUD$
(Table under sys user names AUD..
Any ideas how to resolve this?
Thanks,
Balwanth
