I have the following configuration information:




SQL> spool off;

This tells me that audit data for the SYS user is being saved in a database file. If the SYS user has full access to DB, does this not defeat the purpose of audit SYS files being stored on the DB server?

1 Answer 1



The audit records are written to the operating system's audit trail.

SYS audit entries are not stored in the database, but on the host in text files (or the event log on Windows).

But yes, you are correct, if you are SYS, you have full access to the database, and the host, with the user the database runs as. So yes, you can manipulate audit rules and data as well.

For that reason (and performance-wise), usually I suggest using AUDIT_SYSLOG_LEVEL, and configuring syslog to forward all entries to a remote server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.