On an Oracle 11gr1 database, SYS audit is enabled:

SQL> show parameter audit

NAME                                 TYPE                             VALUE
------------------------------------ -------------------------------- ------------------------------
audit_file_dest                      string                           /oracle/admin/jde9dv/adump
audit_sys_operations                 boolean                          TRUE
audit_syslog_level                   string
audit_trail                          string                           DB_EXTENDED

But when I query the SYS.AUD$ table there is nothing returned:

SQL> select count(*) from sys.aud$;


When I go to /oracle/admin/jde9dv/adump folder, there is a lot of files but none contain my recent SYS activity ...

Where are my audit records ?



I know I am late to the party but anyways:

your AUDIT_TRAIL value should be set to DB,EXTENDED and not DB_EXTENDED.

You can change it with:

alter system set audit_trail=db,extended scope=spfile;

Bear in mind that after setting it to DB,EXTENDED you have to restart your instance for changes to take effect.

Find more on very handy Oracle's documentation:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.