I have a requirement to audit all SELECT queries (by access) against specified tables by specified users.
As far as I can tell, this can't be done with normal auditing; it only supports auditing all queries by specified users or all queries agains specified tables (by any user). This is a problem because there are system accounts that would generate too much audit and needs to be excluded from audit.
This leaves fine grained auditing, where it is possible to do this by specifying appropriate predicate for audit_condition parameter in dbms_fga.add_policy. However, FGA has unfortunate effect of writing duplicate rows in audit trail when parallel query is used; not desirable when the goal is to minimize audit information.
Currently, I'm planning to go with FGA and frequently remove the duplicate rows. Is there any better way to implement this auditing strategy?
sys.aud$
segment header, Pinging ofsys.aud$
data blocks and false pinging in the system tablespace). Luckily, your answer already gives a useful work-around (+1). Thanks!