Finding Information About Audited Activities
Because the audit XML files are stored in files with the .xml extension on all platforms, the dynamic view presents audit information similarly on all platforms. See Oracle Database Reference for detailed information about the V$XML_AUDIT_TRAIL view contents.
Archiving the Standard and Fine-Grained Audit Trails You can create an archive of the standard audit and fine-grained audit trails by exporting their system tables (SYS.AUD$ and SYS.FGA_LOG$) to operating system dump files. You should periodically archive the audit trail to prevent it from growing too large. To archive the standard audit trail or fine-grained audit trail: ■
that are less than the scn column
standard
4.
Finding Information About Audited Activities You can use data dictionary views to work with the audit trail. This section explores the following topics: ■
Using Data Dictionary Views to Find Information About the Audit Trial
■
Using Audit Trail Views to Investigate Suspicious Activities
■
Deleting the Audit Trail Views
Using Data Dictionary Views to Find Information About the Audit Trial Oracle Database stores audit records for standard auditing in the SYS.AUD$ table and audit records for fine-grained auditing the SYS.FGA_LOG$ table. Each of these tables is a single table in each Oracle database data dictionary. Several predefined views are available to present auditing information from this table in a meaningful way. If you decide not to use auditing, then you can later delete these views. For detailed information about these views, see Oracle Database Reference. Table 6–10 lists views that are provide auditing information. Table 6–10
Views That Display Information about the Database Audit Trail
View
Description
ALL_AUDIT_POLICIES
Describes the fine-grained auditing policies on the tables and views accessible to the current user
ALL_AUDIT_POLICY_COLUMNS Describes the fine-grained auditing policy columns on the tables and views accessible to the current user. ALL_DEF_AUDIT_OPTS
Lists default object-auditing options that will be applied when objects are created
AUDIT_ACTIONS
Describes audit trail action type codes
DBA_AUDIT_EXISTS
Lists audit trail entries produced BY AUDIT NOT EXISTS
DBA_AUDIT_OBJECT
Lists audit trail records for all objects in the system
DBA_AUDIT_POLICIES
Lists all the fine-grained auditing policies on the system
DBA_AUDIT_SESSION
Lists all audit trail records concerning CONNECT and DISCONNECT
Configuring Auditing 6-47