Implementing Oracle Database Auditing
Unified auditing
From 12c, Oracle writes all audit records into a single unified audit trail owned by AUDSYS and exposed through UNIFIED_AUDIT_TRAIL. New databases have unified auditing enabled by default. The AUDIT_ADMIN role creates and manages policies; AUDIT_VIEWER may read the trail. Rows cannot be deleted directly - use DBMS_AUDIT_MGMT.
CREATE AUDIT POLICY pol_hr_ddl
PRIVILEGES CREATE ANY TABLE, DROP ANY TABLE
ACTIONS SELECT ON hr.employees;
AUDIT POLICY pol_hr_ddl;
Optional clauses: BY user, WHEN 'condition' (for example a sys_context test), and EVALUATE PER SESSION | ACCESS | STATEMENT, which sets how often the condition is evaluated.
Fine-grained auditing
FGA, driven by DBMS_FGA.ADD_POLICY, audits at row and column level: you supply an object, a policy name, an optional audit condition and audit columns. FGA captures the SQL text and SCN in DBA_FGA_AUDIT_TRAIL (also visible through DBA_COMMON_AUDIT_TRAIL) and is the right answer when the requirement is "audit only SELECTs that return sensitive rows."
Operational points
SYS operations can be audited unconditionally. The legacy AUDIT_TRAIL parameter and DBA_AUDIT_TRAIL still exist for pre-12c style auditing and mixed-mode databases. An unmanaged trail grows until it fills its tablespace, so schedule archive-and-purge with DBMS_AUDIT_MGMT.
Traps: a policy audits both successful and unsuccessful actions unless restricted; creating a policy is not the same as enabling it - you must run AUDIT POLICY; FGA handles row and column conditions, unified policies handle privileges and actions.
Rule of thumb: unified policies for privilege and object auditing, FGA for "who looked at these rows", and either one paired with a purge job.