Comments on: Oracle 11g — Audit Enabled by Default, But What About Purging?

By: Alex Gorbachev

Alex Gorbachev — Wed, 20 Jan 2010 04:05:43 +0000

@Uri: I know it works for number of people just fine. Though, it does pose a question on supportability by Oracle. Strictly speaking, it’s not supported.

I guess it’s the balance between how much overhead is caused by purging it vs danger of running unsupported configuration (though, Oracle Support would probably never notice).

If you collect way too much data and purging it produces huge overhead, I’d question Audit strategy but never say never.

By: Uri

Uri — Wed, 13 Jan 2010 11:06:41 +0000

What can you say regarding making SYS.AUD$ table as partitioned table ?

By: Alex Gorbachev

Alex Gorbachev — Thu, 17 Dec 2009 18:01:28 +0000

@Mehul: I do not agree. There should be an established policy for audit records retention and in many cases, this retention is not unlimited. How these policies should be setup is another question.

The point of the post is that even if you don’t intentionally enable auditing (thus, you might not have an explicit policy) there are some auditing records collected by default and this is already a limited set.

By: Mehul

Mehul — Mon, 30 Nov 2009 18:47:31 +0000

Auto purging Audit records is a bad decision. Audit should only be purged with human intervention. Audit records are very important information which needs to be reviewed carefully and then any action needs to be taken.
The better solution is to restrict the number of audits happening by disabling auditing on objects which are not important.

By: Alex Gorbachev

Alex Gorbachev — Tue, 24 Nov 2009 22:15:31 +0000

@Andy: There is no silver-bullet I’m afraid. Every application has its own audit requirements, retention policies and data access patterns.

By: Andy

Andy — Tue, 24 Nov 2009 11:05:40 +0000

Any info about oracle application auditing – Audit Trail growth..whats the strategy to purge the audit data?

Thanks,

By: Alex Gorbachev

Alex Gorbachev — Wed, 30 Sep 2009 22:27:59 +0000

@Mark: Oracle Database Vault option shouldn't have anything to do with this package. At least, I don't see it mentioned in the licensing guide. Oracle Audit Vault is actually a separate product by itself and dbms_audit_mgmt package is part of it according to the documentation of Audit Vault itself.

By: Mark

Mark — Wed, 30 Sep 2009 20:08:19 +0000

@Alex , you wrote a while back about purging AUD$ data using slick pls/sql script(s) anyway did you find out if the dbms_audit_mgmt package is available without licensing the Vault ? otherwise by purging the AUD$ via homemade scripts, will this cleanup the OS xml files , I havent tested yet, but looking for insight from experienced folk.

Thanks

By: Alex Gorbachev

Alex Gorbachev — Wed, 10 Jun 2009 02:48:31 +0000

@Praveen: from the top of my head, I couldn’t see why this would be an issue in 9i. I don’t have a sand-box with 9i database at the moment but I would think it should work just fine.

Can you select from AUD$?

By: Praveen

Praveen — Mon, 08 Jun 2009 13:09:31 +0000

Hi,what about on older version 9i database.
I have delete previlege on AUD$, but I can’t delete using where timestamp#

delete from SYS.AUD$ where timestamp# < trunc(sysdate,’MONTH’)
Error at line 1
ORA-01031: insufficient privileges

I tried using userid = ‘xxx’ in the where clause instead of timestamp#, they don’t work either.

any ideas?