Mixed mode auditing - 12c

Question

Oracle 12c database comes with default Unified auditing enabled even if we set it to FALSE which has ORA_SECURECONFIG policy enabled by default.

Apparently, the audit options for that particular policy captures many default options such as Alter and create statements.

My question is, by default for any new installation, mixed mode is enabled which means that the traditional auditing is enabled and also Unified auditing is enabled as well both capturing the same audit_options.

Why is it that way? What is the point of Mixed mode? When by default tradionally Oracle audits certain user actions, why should ORA_SECURECONFIG should also audit the same default user actions and write to AUDSYS schema?

And if I need to keep only Unified auditing, then how to disable traditional auditing? Should I change audit_trail from DB to NONE?

Answer 1

In Oracle 12c Mixed Mode is enabled by default which makes the use familiar with Unified Auditing prior to switching to full Unified Auditing. Mixed Mode allows to pre-12c audit functionality to co-exist with new Unified Auditing functionality.

Using Mixed Mode audit data can be found both in the traditional locations as well as in SYS.UNIFIED_AUDIT_TRAIL. This is because the Unified Auditing Policy ORA_SECURECONFIG is enabled by default.

You can use the following commands to disable Unified Audit.

NOAUDIT POLICY ORA_SECURECONFIG; noaudit policy ORA_LOGON_FAILURES;

Unified Auditing is not included in the Oracle 12c kernel so you have enable to manually. But in Mixed Mode it is on though it is not included in the kernel. You can check whether the Unified Auditing is enabled or not using the following query.

select VALUE from V$OPTION where PARAMETER='Unified Auditing'; If you wish to linked the Unified Auditing to kernel then use the following commands.

cd $ORACLE_HOME/rdbms/lib make -f ins_rdbms.mk uniaud_on ioracle ORACLE_HOME=$ORACLE_HOME

If you dont set AUDIT_TRAIL=NONE then both auditing mechanisms will run concurrently.

Reference

Link to Oracle Official Documentation.

Mixed Mode Auditing