Oracle SYS Auditing with Audit Trail to DB

Question

I have an Oracle Database 11g R2 on Oracle Enterprise Linux. I have enabled SYS auditing as:

SQL> ALTER SYSTEM SET audit_sys_operations=true SCOPE=spfile;

SQL> ALTER SYSTEM SET audit_trail=OS SCOPE=spfile;

SQL> SHUTDOWN IMMEDIATE

SQL> STARTUP

The audit information is storing in adump folder. But I want to set audit trail to Database(i-e: in SYS.AUD$). I have tried this:

SQL> ALTER SYSTEM SET audit_trail=DB SCOPE=spfile;

SQL> SHUTDOWN IMMEDIATE

SQL> STARTUP

but after this setting, audit records are not going to SYS.AUD$ but instead these are going to operating system adump folder. So how can I set audit trail to database?

Answer 1

This is expected behaviour SYS auditing will always go to the filesystem.

The documentation for AUDIT_FILE_DEST states:

Oracle Database also writes mandatory auditing information to this location, and if the AUDIT_SYS_OPERATIONS initialization parameter is *set, writes audit records for user SYS*.

... and the documentation for AUDIT_SYS_OPERATIONS states:

Enables or disables the auditing of top-level operations directly issued by user SYS, and users connecting with SYSDBA or SYSOPER privilege. Oracle Database writes the audit records to the audit trail of the operating system. If you set the AUDIT_TRAIL initialization parameter to XML or XML, EXTENDED, it writes the audit records in XML format. On UNIX systems, if you have also set the AUDIT_SYSLOG_LEVEL parameter, then it overrides the AUDIT_TRAIL parameter, which writes the SYS audit records to the system audit log using the SYSLOG utility.

Documentation link here.

Answer 2

@Phil's explanation is correct, but missing one point here (or perhaps you meant it implicitly, sorry for not understanding): WHY must it be filesystem, and database is not good enough?

Reason here is: because Oracle user is the owner of database, and thus can login as SYS via "as sysdba" without password, and so can also delete anything he wanted. Thus that defeats the purpose of auditing SYS via database.

But writing to the filesystem is different. And when AUDIT_SYSLOG_LEVEL is set:

https://docs.oracle.com/cd/B28359_01/server.111/b28320/initparams016.htm

then syslog will be used, meaning that by using syslog() logging the output will be redirected to a root-owned filesystem (to be configured, for eg, to /var/log/audit.log), so that even the Oracle user who installed the database cannot read the content of /var/log/audit.log, and cannot modify it.

For info see here:

https://uhesse.com/2010/02/02/how-to-audit-sys-into-an-os-file-owned-by-root/