Implementing Oracle Database Auditing
Scope
This domain tests Oracle 19c unified auditing: policies, enabling, audit trails, and purge jobs. Expect questions on where an audit record is written and how to audit a specific action.
Core rules
- Unified auditing is enabled by default in Oracle 19c; traditional AUDIT_TRAIL auditing is legacy. Unified audit records go to the unified audit trail, exposed by V$UNIFIED_AUDIT_TRAIL and related views.
- CREATE AUDIT POLICY defines actions; AUDIT POLICY enables it. Policies can be enabled for all users or BY user. AUDIT_ADMIN manages audit policies; AUDIT_VIEWER can view trails.
- Mandatory audits such as SYSDBA actions cannot be disabled. DBMS_AUDIT_MGMT manages trail tablespaces, purge jobs, and archival.
- DBA_AUDIT_POLICIES, AUDIT_UNIFIED_POLICIES, and AUDIT_UNIFIED_ENABLED_POLICIES show configuration.
Worked example
CREATE AUDIT POLICY pol_emp_select ACTIONS SELECT ON hr.employees; AUDIT POLICY pol_emp_select BY hr; A SELECT by HR on hr.employees is captured. Query V$UNIFIED_AUDIT_TRAIL WHERE DBUSERNAME='HR' AND OBJECT_NAME='EMPLOYEES' to confirm. To stop auditing, run NOAUDIT POLICY pol_emp_select.
Traps
Setting AUDIT_TRAIL=NONE does not disable unified auditing in 19c. A policy must be enabled, not just created. Auditing SELECT does not audit DML. The audit trail is not the alert log.