Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have an Oracle Database 11g R2 on Oracle Enterprise Linux. I have enabled SYS auditing as:

SQL> ALTER SYSTEM SET audit_sys_operations=true SCOPE=spfile;

SQL> ALTER SYSTEM SET audit_trail=OS SCOPE=spfile;

SQL> SHUTDOWN IMMEDIATE

SQL> STARTUP

The audit information is storing in adump folder. But I want to set audit trail to Database(i-e: in SYS.AUD$). I have tried this:

SQL> ALTER SYSTEM SET audit_trail=DB SCOPE=spfile;

SQL> SHUTDOWN IMMEDIATE

SQL> STARTUP

but after this setting, audit records are not going to SYS.AUD$ but instead these are going to operating system adump folder. So how can I set audit trail to database?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

This is expected behaviour SYS auditing will always go to the filesystem.

The documentation for AUDIT_FILE_DEST states:

Oracle Database also writes mandatory auditing information to this location, and if the AUDIT_SYS_OPERATIONS initialization parameter is *set, writes audit records for user SYS*.

... and the documentation for AUDIT_SYS_OPERATIONS states:

Enables or disables the auditing of top-level operations directly issued by user SYS, and users connecting with SYSDBA or SYSOPER privilege. Oracle Database writes the audit records to the audit trail of the operating system. If you set the AUDIT_TRAIL initialization parameter to XML or XML, EXTENDED, it writes the audit records in XML format. On UNIX systems, if you have also set the AUDIT_SYSLOG_LEVEL parameter, then it overrides the AUDIT_TRAIL parameter, which writes the SYS audit records to the system audit log using the SYSLOG utility.

Documentation link here.

share|improve this answer
    
Phil, thanks for explain. –  Memon Jan 29 at 7:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.