0

Oracle 12c database comes with default Unified auditing enabled even if we set it to FALSE which has ORA_SECURECONFIG policy enabled by default.

Apparently, the audit options for that particular policy captures many default options such as Alter and create statements.

My question is, by default for any new installation, mixed mode is enabled which means that the traditional auditing is enabled and also Unified auditing is enabled as well both capturing the same audit_options.

Why is it that way? What is the point of Mixed mode? When by default tradionally Oracle audits certain user actions, why should ORA_SECURECONFIG should also audit the same default user actions and write to AUDSYS schema?

And if I need to keep only Unified auditing, then how to disable traditional auditing? Should I change audit_trail from DB to NONE?

1

In Oracle 12c Mixed Mode is enabled by default which makes the use familiar with Unified Auditing prior to switching to full Unified Auditing. Mixed Mode allows to pre-12c audit functionality to co-exist with new Unified Auditing functionality.

Using Mixed Mode audit data can be found both in the traditional locations as well as in SYS.UNIFIED_AUDIT_TRAIL. This is because the Unified Auditing Policy ORA_SECURECONFIG is enabled by default.

You can use the following commands to disable Unified Audit.

NOAUDIT POLICY ORA_SECURECONFIG; noaudit policy ORA_LOGON_FAILURES;

Unified Auditing is not included in the Oracle 12c kernel so you have enable to manually. But in Mixed Mode it is on though it is not included in the kernel. You can check whether the Unified Auditing is enabled or not using the following query.

select VALUE from V$OPTION where PARAMETER='Unified Auditing'; If you wish to linked the Unified Auditing to kernel then use the following commands.

cd $ORACLE_HOME/rdbms/lib make -f ins_rdbms.mk uniaud_on ioracle ORACLE_HOME=$ORACLE_HOME

If you dont set AUDIT_TRAIL=NONE then both auditing mechanisms will run concurrently.

Reference

Link to Oracle Official Documentation.

Mixed Mode Auditing

  • Thanks but I asked on disabling the traditional auditing, which is making audit_trail to none right? And it makes sense to disable unified auditing when traditional method is enabled right? – tesla747 May 28 '16 at 7:51
  • I have edited my answer to address your comment. :) – JSapkota May 28 '16 at 8:29
  • Thanks, can you explain what do you mean by not included in kernel? Also, if I set to NONE, and leave Unified to default then traditional auditing will be disabled and only Unified will be enabled right? – tesla747 May 28 '16 at 9:14
  • Not included in kernel means its a separate module which should be linked to Oracle engine manually. Yes according the documentation, but have not tested on my machine. ;) – JSapkota May 28 '16 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.