Lutz Haake | Freelance Oracle Consultant

I’m learning about unified auditing on 19c, how to set it up, and how to audit DML and DDL activities.

On Windows, it takes to stop all oracle processes, rename a DLL and restart the instance. Due to late binding, no relink is needed.

After restart, the Unified Auditing option is available:

This is the confi­gu­ration for “pure” unified auditing. Audit data will no longer be stored in SYS.AUD$, instead in AUDSYS.AUD$UNIFIED. In “mixed mode” (with AUDIT_TRAIL set to other than NONE), both will be populated. Audit data is presented in merged form through the UNIFIED _AUDIT_TRAIL view.

Here’s my test script. Part 1 sets up auditing for all DML and DDL activities:

Part 2 generates the audit data:

The first part is run as SYS, the second part is run in a separate session, which I want to audit. Both sessions are active. At this point, I was expecting the new policies to become active immediately.

But they didn’t. My audit trail looked quite discou­raging at this point. It showed the purging of the audit trail, deployment of the policies, but, no DDL and DML activity at all.

I regained my compo­sition and did more research. At last, a hint was found! 

So true. After recon­necting the session that executes part 2 of the test script, auditing finally happens.

The documen­tation can be found here.

I was easy for me to overlook, and I did not find it mentioned in general. As of 21c, the behaviour has changed (link):

perplexity.ai was able to find this piece of infor­mation — fascinating!