We're redoing what is and isn't being auditing in a database my team has been put in charge of. Old audit settings were producing ~2M audit entries a day.
Audit_trail parameter is set to DB.
So we wipe everything that is being auditing out with NOAUDIT commands, run the audit commands of our bare minimum, and then see how many entries are created come the next day. It's the same rate with the same ratio of specific kinds of entries (ie. hundreds of thousands of successful select statements). In this case we audited select table whenever not successful to start out, so the successful selects should = 0.
Dba_obj_audit_opts is empty and
dba_priv_audit_opts is what we expected.
Dba_stmt_audit_opts is what we expect, which should have produced infinitely less audit records than the previous settings.
sys.audit$ perfectly mirrors
So to test whether I misunderstood how some of the audit settings worked (ie some of the system privilege auditing), we simply wipe out all of the audit options again with NOAUDIT statements.
sys.audit$ is down to 1 entry auditing PUBLIC's MANAGE ANY FILE GROUP usage, which I'm assuming is some default setting I should leave alone. Wait a few minutes, and the same ratio and kinds of entries are being created in the
sys.aud$ table with the newest happening a second before I queried the
I'm sure it's something simple, but I'm stumped as to what is telling Oracle what to audit that is superseding what the audit options are telling it to audit.