Audit parameters. What do they mean - short description

When managing your audit trail, you will need to be familiar with these settings. Here is a short description of what they mean.

SQL> SELECT NAME, VALUE FROM V$PARAMETER WHERE NAME LIKE '%audit%';

NAME	VALUE
audit_sys_operations	TRUE
audit_file_dest	/u01/oracle/admin/slyt/adump
audit_syslog_level
audit_trail	DB_EXTENDED

AUDIT_TRAIL
When set to "DB", Oracle directs audit records to the database audit trail (the SYS.AUD$ table), except for mandatory and SYS audit records, which are always written to the operating system audit trail.

When set to "DB,EXTENDED", oracle behaves as it would when AUDIT_TRAIL=DB, but also enables you to capture the SQL statement used in the action that was audited.

When set to "NONE", standard auditing is disabled

When set to "OS", Oracle directs all audit records to an operating system file.

When set to "XML", Oracle writes to the operating system audit record file in XML format

When set to "XML, EXTENDED", oracle behaves as it would with "AS AUDIT_TRAIL=XML", but also includes SQL text and SQL bind information

AUDIT_SYS_OPERATIONS
Enables or disables the auditing of top-level operations, which are SQL statements directly issued by users when connecting with SYSDBA or SYSOPER privileges.

AUDIT_FILE_DEST
specifies the operating system directory into which the audit trail is written when the AUDIT_TRAIL initialization parameter is set to os, xml, or xml,extended. It is also the location to which mandatory auditing information is written and, if so specified by the AUDIT_SYS_OPERATIONS initialization parameter, audit records for user SYS.

AUDIT_SYSLOG_LEVEL
Allows SYS and standard OS audit records to be written to the system audit log using the SYSLOG utility


Note: when you set the audit_trail parameter in the spfile, DO NOT use qotation marks around the values: Incorrect:

alter system set audit_trail='DB,EXTENDED' scope=spfile;

ORA-00096: invalid value DB,EXTENDED for parameter audit_trail, must be from among extended, xml, none, os, db

Correct:

alter system set audit_trail=db,extended scope=spfile;

System altered.