{"id":4068,"date":"2020-11-04T13:49:59","date_gmt":"2020-11-04T19:49:59","guid":{"rendered":"http:\/\/www.aamirharoon.com\/?p=4068"},"modified":"2020-11-04T13:50:02","modified_gmt":"2020-11-04T19:50:02","slug":"unified-auditing","status":"publish","type":"post","link":"http:\/\/www.aamirharoon.com\/?p=4068","title":{"rendered":"Unified Auditing"},"content":{"rendered":"\n<div class=\"wp-block-simple-note-info\">Starting with 20c, Traditional Auditing has been deprecated. Oracle recommends to migrate to Unified Auditing. <a href=\"https:\/\/docs.oracle.com\/en\/database\/oracle\/oracle-database\/20\/dbseg\/release-changes.html#GUID-C47953BD-505D-45A6-B29B-57109F68DF10\" target=\"_blank\" rel=\"noreferrer noopener\">Click here to read more<\/a><\/div>\n\n\n<p>In this blog post I am sharing my notes about Unified Auditing.\u00a0 It shows how to enable and purge Unified Audit data.<\/p>\n<p>From Oracle Documents:<\/p>\n<blockquote>\n<h3><b>What Is Unified Auditing?<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">In unified auditing, the unified audit trail captures audit information from a variety of sources.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Unified auditing enables you to capture audit records from the following sources:<\/span><\/p>\n<\/blockquote>\n<ul>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Audit records (including\u00a0<\/span><span style=\"font-weight: 400;\">SYS<\/span><span style=\"font-weight: 400;\">\u00a0audit records) from unified audit policies and\u00a0<\/span><span style=\"font-weight: 400;\">AUDIT<\/span><span style=\"font-weight: 400;\">\u00a0settings<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Fine-grained audit records from the\u00a0<\/span><span style=\"font-weight: 400;\">DBMS_FGA<\/span><span style=\"font-weight: 400;\">\u00a0PL\/SQL package<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle Database Real Application Security audit records<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle Recovery Manager audit records<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle Database Vault audit records<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle Label Security audit records<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle Data Mining records<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle Data Pump<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><span style=\"font-weight: 400;\">Oracle SQL*Loader Direct Load<\/span><\/p>\n<\/blockquote>\n<\/li>\n<\/ul>\n<h3><b>Mixed Mode or Pure Unified Auditing?<\/b><\/h3>\n<blockquote>\n<table>\n<tbody>\n<tr>\n<td><b>Mode<\/b><\/td>\n<td><b>Features<\/b><\/td>\n<td><b>How to Enable<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Mixed mode auditing<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Has both traditional and unified auditing<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Enable any unified audit policy. There is no need to restart the database.<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Pure unified auditing<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Has only unified auditing<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Link the\u00a0<\/span><span style=\"font-weight: 400;\">oracle<\/span><span style=\"font-weight: 400;\">\u00a0binary with\u00a0<\/span><span style=\"font-weight: 400;\">uniaud_on<\/span><span style=\"font-weight: 400;\">, and then restart the database.<\/span><i><span style=\"font-weight: 400;\">Oracle Database Upgrade Guide<\/span><\/i><span style=\"font-weight: 400;\">\u00a0describes how to enable pure unified auditing.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/blockquote>\n<h3>More About Unified Auditing<\/h3>\n<blockquote>\n<p><span style=\"font-weight: 400;\">The unified audit trail, which resides in a read-only table in the\u00a0<\/span><span style=\"font-weight: 400;\">AUDSYS<\/span><span style=\"font-weight: 400;\">\u00a0schema in the\u00a0<\/span><span style=\"font-weight: 400;\">SYSAUX<\/span><span style=\"font-weight: 400;\">\u00a0tablespace, makes this information available in a uniform format in the\u00a0<\/span><span style=\"font-weight: 400;\">UNIFIED_AUDIT_TRAIL<\/span><span style=\"font-weight: 400;\">\u00a0data dictionary view, and is available in both single-instance and Oracle Database Real Application Clusters environments. In addition to the user\u00a0<\/span><span style=\"font-weight: 400;\">SYS<\/span><span style=\"font-weight: 400;\">, users who have been granted the\u00a0<\/span><span style=\"font-weight: 400;\">AUDIT_ADMIN<\/span><span style=\"font-weight: 400;\"> and\u00a0<\/span><span style=\"font-weight: 400;\">AUDIT_VIEWER<\/span><span style=\"font-weight: 400;\">\u00a0roles can query these views. If your users only need to query the views but not create audit policies, then grant them the\u00a0<\/span><span style=\"font-weight: 400;\">AUDIT_VIEWER<\/span><span style=\"font-weight: 400;\">\u00a0role.<\/span><\/p>\n<\/blockquote>\n<ul>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><b>AUDIT_ADMIN Role.<\/b><span style=\"font-weight: 400;\">\u00a0This role enables you to create unified and fine-grained audit policies, use the\u00a0<\/span><span style=\"font-weight: 400;\">AUDIT<\/span><span style=\"font-weight: 400;\">\u00a0and\u00a0<\/span><span style=\"font-weight: 400;\">NOAUDIT<\/span><span style=\"font-weight: 400;\">\u00a0SQL statements, view audit data, and manage the audit trail administration. Grant this role only to trusted users.<\/span><\/p>\n<\/blockquote>\n<\/li>\n<li style=\"font-weight: 400;\">\n<blockquote>\n<p><b>AUDIT_VIEWER Role.<\/b><span style=\"font-weight: 400;\">\u00a0This role enables users to view and analyze audit data. The kind of user who needs this role is typically an external auditor.<\/span><\/p>\n<\/blockquote>\n<\/li>\n<\/ul>\n<h3><b>How To Enable Audit Policies:<\/b><\/h3>\n<pre><span style=\"font-weight: 400;\">AUDIT POLICY ORA_LOGON_FAILURES<\/span>\n<span style=\"font-weight: 400;\"> \u00a0EXCEPT DBSNMP<\/span>\n<span style=\"font-weight: 400;\"> \u00a0WHENEVER NOT SUCCESSFUL;<\/span>\n\n<span style=\"font-weight: 400;\">AUDIT POLICY ORA_SECURECONFIG\n<\/span><span style=\"font-weight: 400;\">EXCEPT DBSNMP;\n\n<\/span><span style=\"font-weight: 400;\">AUDIT POLICY ORA_DATABASE_PARAMETER;<\/span><\/pre>\n<h3><b>How To Purge Audit Data<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Following procedure sets the LAST_ARCHIVE_TIME (or retention to 30 days).<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">BEGIN<\/span>\n<span style=\"font-weight: 400;\">\u00a0 DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(<\/span>\n<span style=\"font-weight: 400;\"> \u00a0 AUDIT_TRAIL_TYPE \u00a0 \u00a0 =&gt;\u00a0 DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,<\/span>\n<span style=\"font-weight: 400;\"> \u00a0 LAST_ARCHIVE_TIME\u00a0 \u00a0 =&gt;\u00a0 SYSDATE - <\/span><span style=\"font-weight: 400;\">30<\/span><span style=\"font-weight: 400;\"> );<\/span>\n<span style=\"font-weight: 400;\">END;<\/span>\n<span style=\"font-weight: 400;\">\/<\/span><\/pre>\n<p><span style=\"font-weight: 400;\">Create a Purge Job\u00a0which deletes based on LAST_ARCHIVE_TIME<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">BEGIN<\/span>\n<span style=\"font-weight: 400;\">\u00a0 DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (<\/span>\n<span style=\"font-weight: 400;\"> \u00a0 AUDIT_TRAIL_TYPE\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 =&gt; DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED, <\/span>\n<span style=\"font-weight: 400;\"> \u00a0 AUDIT_TRAIL_PURGE_INTERVAL\u00a0 =&gt; 12,<\/span>\n<span style=\"font-weight: 400;\"> \u00a0 AUDIT_TRAIL_PURGE_NAME\u00a0 \u00a0 \u00a0 =&gt; 'Audit_Trail_PURGE',<\/span>\n<span style=\"font-weight: 400;\"> \u00a0 USE_LAST_ARCH_TIMESTAMP \u00a0 \u00a0 =&gt; TRUE );<\/span>\n<span style=\"font-weight: 400;\">END;<\/span>\n<span style=\"font-weight: 400;\">\/<\/span><\/pre>\n<h2><b>How To Change The Tablespace For Unified Audit Tables:<\/b><\/h2>\n<pre><span style=\"font-weight: 400;\">set echo on<\/span>\n\n<span style=\"font-weight: 400;\">col parameter_name format a30<\/span>\n<span style=\"font-weight: 400;\">col parameter_value format a20<\/span>\n\n<span style=\"font-weight: 400;\">select * from DBA_AUDIT_MGMT_CONFIG_PARAMS<\/span>\n<span style=\"font-weight: 400;\">where AUDIT_TRAIL = 'UNIFIED AUDIT TRAIL';<\/span>\n\n<span style=\"font-weight: 400;\">PARAMETER_NAME \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 PARAMETER_VALUE\u00a0 \u00a0 \u00a0 AUDIT_TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\n<span style=\"font-weight: 400;\">------------------------------ -------------------- ----------------------------<\/span>\n<span style=\"font-weight: 400;\">AUDIT FILE MAX SIZE\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 10000\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>\n<span style=\"font-weight: 400;\">AUDIT FILE MAX AGE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 5\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>\n<span style=\"font-weight: 400;\">DB AUDIT TABLESPACE\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <\/span><span style=\"font-weight: 400; color: #ff0000;\">SYSAUX<\/span><span style=\"font-weight: 400;\"><span style=\"color: #ff0000;\"> \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/span> UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\n<span style=\"font-weight: 400;\">AUDIT WRITE MODE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 QUEUED WRITE MODE\u00a0 \u00a0 UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>\n\n<span style=\"font-weight: 400;\">4 rows selected.<\/span>\n\n<span style=\"color: #008000;\">--Create tablespace<\/span>\n<span style=\"font-weight: 400;\">CREATE TABLESPACE DBAUDIT DATAFILE\u00a0<\/span>\n<span style=\"font-weight: 400;\"> \u00a0'+DATA' SIZE 100M AUTOEXTEND ON NEXT 512M MAXSIZE 65535M<\/span>\n<span style=\"font-weight: 400;\">ONLINE<\/span>\n<span style=\"font-weight: 400;\">EXTENT MANAGEMENT LOCAL AUTOALLOCATE<\/span>\n<span style=\"font-weight: 400;\">BLOCKSIZE 16K<\/span>\n<span style=\"font-weight: 400;\">SEGMENT SPACE MANAGEMENT AUTO<\/span>\n<span style=\"font-weight: 400;\">FLASHBACK ON;<\/span>\n\n<span style=\"font-weight: 400;\">Tablespace created.<\/span>\n\n<span style=\"color: #008000;\">--update the tablespace for Unified Audit<\/span>\n<span style=\"font-weight: 400;\">BEGIN<\/span>\n<span style=\"font-weight: 400;\">DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION(<\/span>\n<span style=\"font-weight: 400;\"> \u00a0\u00a0\u00a0audit_trail_type \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 =&gt; DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,<\/span>\n<span style=\"font-weight: 400;\"> \u00a0\u00a0\u00a0audit_trail_location_value =&gt; 'DBAUDIT');<\/span>\n<span style=\"font-weight: 400;\">END;<\/span>\n<span style=\"font-weight: 400;\">\/<\/span>\n\n<span style=\"font-weight: 400;\">PL\/SQL procedure successfully completed.<\/span>\n\n<span style=\"font-weight: 400;\">select * from DBA_AUDIT_MGMT_CONFIG_PARAMS<\/span>\n<span style=\"font-weight: 400;\">where AUDIT_TRAIL = 'UNIFIED AUDIT TRAIL';\n\nPARAMETER_NAME \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 PARAMETER_VALUE\u00a0 \u00a0 \u00a0 AUDIT_TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\n------------------------------ -------------------- ----------------------------\nAUDIT FILE MAX SIZE\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 10000\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \nAUDIT FILE MAX AGE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 5\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \nDB AUDIT TABLESPACE\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 <span style=\"color: #ff0000;\">DBAUDIT \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/span> UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\nAUDIT WRITE MODE \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 QUEUED WRITE MODE\u00a0 \u00a0 UNIFIED AUDIT TRAIL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \n\n4 rows selected.\n<\/span><\/pre>\n<h3><b>Need Another Job To Advance <\/b><b>LAST_ARCHIVE_TIMESTAMP<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Create a procedure to advance LAST_ARCHIVE_TIME<\/span><\/p>\n<pre><span style=\"font-weight: 400;\">create or replace procedure set_audit_archive_retention<\/span>\n<span style=\"font-weight: 400;\">(retention in number default 30) as<\/span>\n<span style=\"font-weight: 400;\">BEGIN<\/span>\n<span style=\"font-weight: 400;\">\u00a0 DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(<\/span>\n<span style=\"font-weight: 400;\"> \u00a0 AUDIT_TRAIL_TYPE \u00a0 \u00a0 =&gt;\u00a0 DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,<\/span>\n<span style=\"font-weight: 400;\"> \u00a0\u00a0last_archive_time \u00a0 \u00a0 =&gt;\u00a0 sysdate - retention);<\/span>\n<span style=\"font-weight: 400;\">end;<\/span>\n<span style=\"font-weight: 400;\">\/<\/span>\n\n<span style=\"font-weight: 400; color: #008000;\">--Create a database scheduler job.\u00a0 Change \u201c30\u201d to whatever your requirements are.<\/span>\n<span style=\"font-weight: 400;\">BEGIN<\/span>\n<span style=\"font-weight: 400;\">  sys.dbms_scheduler.create_job(<\/span>\n<span style=\"font-weight: 400;\">    job_name            =&gt; 'advance_archive_timestamp',<\/span>\n<span style=\"font-weight: 400;\">    job_type            =&gt; 'STORED_PROCEDURE',<\/span>\n<span style=\"font-weight: 400;\">    job_action          =&gt; 'set_audit_archive_retention',<\/span>\n<span style=\"font-weight: 400;\">    repeat_interval     =&gt; 'FREQ=DAILY;interval=12',<\/span>\n<span style=\"font-weight: 400;\">    number_of_arguments =&gt; 1,<\/span>\n<span style=\"font-weight: 400;\">    start_date          =&gt; systimestamp at time zone 'America\/New_York',<\/span>\n<span style=\"font-weight: 400;\">    job_class           =&gt; '\"DEFAULT_JOB_CLASS\"',<\/span>\n<span style=\"font-weight: 400;\">    comments            =&gt; 'Advance the last archive timestamp by <span style=\"color: #800000;\">30<\/span> days',<\/span>\n<span style=\"font-weight: 400;\">    auto_drop           =&gt; TRUE,<\/span>\n<span style=\"font-weight: 400;\">    enabled             =&gt; FALSE);<\/span>\n\n<span style=\"font-weight: 400;\">  dbms_scheduler.set_job_argument_value<\/span><span style=\"font-weight: 400;\">(\n    job_name          =&gt; 'advance_archive_timestamp',<\/span>\n<span style=\"font-weight: 400;\">    argument_position =&gt; 1,<\/span>\n<span style=\"font-weight: 400;\">    argument_value    =&gt; <\/span><span style=\"font-weight: 400; color: #800000;\">30<\/span><span style=\"font-weight: 400;\">);<\/span> <br \/><br \/><span style=\"font-weight: 400;\">  sys.dbms_scheduler.enable( 'advance_archive_timestamp' );<\/span>\n<span style=\"font-weight: 400;\">END;<\/span>\n<span style=\"font-weight: 400;\">\/<\/span><\/pre>\n<h3><b>Helpful Views\/Tables:<\/b><\/h3>\n<pre><span style=\"font-weight: 400;\">select * from DBA_AUDIT_MGMT_CLEAN_EVENTS;<\/span>\n<span style=\"font-weight: 400;\">select * from DBA_AUDIT_MGMT_CLEANUP_JOBS;<\/span>\n<span style=\"font-weight: 400;\">select * from DBA_AUDIT_MGMT_CONFIG_PARAMS;<\/span>\n<span style=\"font-weight: 400;\">select * from DBA_AUDIT_MGMT_LAST_ARCH_TS;<\/span>\n<span style=\"font-weight: 400;\">select * from AUDIT_UNIFIED_ENABLED_POLICIES; <\/span>\n\n<span style=\"font-weight: 400;\">col POLICY_NAME format A20<\/span>\n<span style=\"font-weight: 400;\">col AUDIT_OPTION format A40<\/span>\n<span style=\"font-weight: 400;\">set PAGES 100<\/span>\n<span style=\"font-weight: 400;\">select POLICY_NAME, AUDIT_OPTION <\/span>\n<span style=\"font-weight: 400;\">   from AUDIT_UNIFIED_POLICIES <\/span>\n<span style=\"font-weight: 400;\">  where policy_name = 'ORA_SECURECONFIG' order by 2 ;<\/span><\/pre>\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\"><div class=\"wp-block-group__inner-container\"><\/div><\/div>\n<\/div><\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>In this blog post I am sharing my notes about Unified Auditing.\u00a0 It shows how to enable and purge Unified Audit data. From Oracle Documents:<\/p>\n","protected":false},"author":1,"featured_media":4096,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,52],"tags":[56,53],"class_list":["post-4068","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-12cr1","category-oracle-database-19c","tag-audit","tag-oracle-database"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Unified Auditing - The Database Handyman<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/www.aamirharoon.com\/?p=4068\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Unified Auditing - The Database Handyman\" \/>\n<meta property=\"og:description\" content=\"In this blog post I am sharing my notes about Unified Auditing.\u00a0 It shows how to enable and purge Unified Audit data. From Oracle Documents:\" \/>\n<meta property=\"og:url\" content=\"http:\/\/www.aamirharoon.com\/?p=4068\" \/>\n<meta property=\"og:site_name\" content=\"The Database Handyman\" \/>\n<meta property=\"article:published_time\" content=\"2020-11-04T19:49:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-11-04T19:50:02+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"640\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Aamir\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@aamir814\" \/>\n<meta name=\"twitter:site\" content=\"@aamir814\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Aamir\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#article\",\"isPartOf\":{\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068\"},\"author\":{\"name\":\"Aamir\",\"@id\":\"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63\"},\"headline\":\"Unified Auditing\",\"datePublished\":\"2020-11-04T19:49:59+00:00\",\"dateModified\":\"2020-11-04T19:50:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068\"},\"wordCount\":415,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63\"},\"image\":{\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg\",\"keywords\":[\"audit\",\"oracle database\"],\"articleSection\":[\"Oracle Database 12cR1\",\"Oracle Database 19c\"],\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/www.aamirharoon.com\/?p=4068#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068\",\"url\":\"http:\/\/www.aamirharoon.com\/?p=4068\",\"name\":\"Unified Auditing - The Database Handyman\",\"isPartOf\":{\"@id\":\"http:\/\/www.aamirharoon.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage\"},\"image\":{\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg\",\"datePublished\":\"2020-11-04T19:49:59+00:00\",\"dateModified\":\"2020-11-04T19:50:02+00:00\",\"breadcrumb\":{\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/www.aamirharoon.com\/?p=4068\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage\",\"url\":\"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg\",\"contentUrl\":\"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg\",\"width\":960,\"height\":640,\"caption\":\"Photo by Markus Spiske on Unsplash\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/www.aamirharoon.com\/?p=4068#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/www.aamirharoon.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Unified Auditing\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.aamirharoon.com\/#website\",\"url\":\"http:\/\/www.aamirharoon.com\/\",\"name\":\"The Database Handyman\",\"description\":\"My notes about Oracle Database, APEX, OEM Cloud Control and whatever I learn\",\"publisher\":{\"@id\":\"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/www.aamirharoon.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63\",\"name\":\"Aamir\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"http:\/\/www.aamirharoon.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63cc5bb07711a1b9719cc47e13a8205072859c1aef30fac28f412baa84b9cf9b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63cc5bb07711a1b9719cc47e13a8205072859c1aef30fac28f412baa84b9cf9b?s=96&d=mm&r=g\",\"caption\":\"Aamir\"},\"logo\":{\"@id\":\"http:\/\/www.aamirharoon.com\/#\/schema\/person\/image\/\"},\"sameAs\":[\"http:\/\/www.aamirharoon.com\/about\/\",\"https:\/\/x.com\/aamir814\"],\"url\":\"http:\/\/www.aamirharoon.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Unified Auditing - The Database Handyman","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/www.aamirharoon.com\/?p=4068","og_locale":"en_US","og_type":"article","og_title":"Unified Auditing - The Database Handyman","og_description":"In this blog post I am sharing my notes about Unified Auditing.\u00a0 It shows how to enable and purge Unified Audit data. From Oracle Documents:","og_url":"http:\/\/www.aamirharoon.com\/?p=4068","og_site_name":"The Database Handyman","article_published_time":"2020-11-04T19:49:59+00:00","article_modified_time":"2020-11-04T19:50:02+00:00","og_image":[{"width":960,"height":640,"url":"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg","type":"image\/jpeg"}],"author":"Aamir","twitter_card":"summary_large_image","twitter_creator":"@aamir814","twitter_site":"@aamir814","twitter_misc":{"Written by":"Aamir","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/www.aamirharoon.com\/?p=4068#article","isPartOf":{"@id":"http:\/\/www.aamirharoon.com\/?p=4068"},"author":{"name":"Aamir","@id":"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63"},"headline":"Unified Auditing","datePublished":"2020-11-04T19:49:59+00:00","dateModified":"2020-11-04T19:50:02+00:00","mainEntityOfPage":{"@id":"http:\/\/www.aamirharoon.com\/?p=4068"},"wordCount":415,"commentCount":0,"publisher":{"@id":"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63"},"image":{"@id":"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage"},"thumbnailUrl":"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg","keywords":["audit","oracle database"],"articleSection":["Oracle Database 12cR1","Oracle Database 19c"],"inLanguage":"en","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/www.aamirharoon.com\/?p=4068#respond"]}]},{"@type":"WebPage","@id":"http:\/\/www.aamirharoon.com\/?p=4068","url":"http:\/\/www.aamirharoon.com\/?p=4068","name":"Unified Auditing - The Database Handyman","isPartOf":{"@id":"http:\/\/www.aamirharoon.com\/#website"},"primaryImageOfPage":{"@id":"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage"},"image":{"@id":"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage"},"thumbnailUrl":"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg","datePublished":"2020-11-04T19:49:59+00:00","dateModified":"2020-11-04T19:50:02+00:00","breadcrumb":{"@id":"http:\/\/www.aamirharoon.com\/?p=4068#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["http:\/\/www.aamirharoon.com\/?p=4068"]}]},{"@type":"ImageObject","inLanguage":"en","@id":"http:\/\/www.aamirharoon.com\/?p=4068#primaryimage","url":"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg","contentUrl":"http:\/\/www.aamirharoon.com\/wp-content\/uploads\/2020\/11\/markus-spiske-2VMcpbUR6w8-unsplash-e1608058203745.jpg","width":960,"height":640,"caption":"Photo by Markus Spiske on Unsplash"},{"@type":"BreadcrumbList","@id":"http:\/\/www.aamirharoon.com\/?p=4068#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/www.aamirharoon.com\/"},{"@type":"ListItem","position":2,"name":"Unified Auditing"}]},{"@type":"WebSite","@id":"http:\/\/www.aamirharoon.com\/#website","url":"http:\/\/www.aamirharoon.com\/","name":"The Database Handyman","description":"My notes about Oracle Database, APEX, OEM Cloud Control and whatever I learn","publisher":{"@id":"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/www.aamirharoon.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":["Person","Organization"],"@id":"http:\/\/www.aamirharoon.com\/#\/schema\/person\/dbcd256c4a97c6e27b7cc408200a9b63","name":"Aamir","image":{"@type":"ImageObject","inLanguage":"en","@id":"http:\/\/www.aamirharoon.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63cc5bb07711a1b9719cc47e13a8205072859c1aef30fac28f412baa84b9cf9b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63cc5bb07711a1b9719cc47e13a8205072859c1aef30fac28f412baa84b9cf9b?s=96&d=mm&r=g","caption":"Aamir"},"logo":{"@id":"http:\/\/www.aamirharoon.com\/#\/schema\/person\/image\/"},"sameAs":["http:\/\/www.aamirharoon.com\/about\/","https:\/\/x.com\/aamir814"],"url":"http:\/\/www.aamirharoon.com\/?author=1"}]}},"_links":{"self":[{"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/posts\/4068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4068"}],"version-history":[{"count":19,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/posts\/4068\/revisions"}],"predecessor-version":[{"id":4105,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/posts\/4068\/revisions\/4105"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=\/wp\/v2\/media\/4096"}],"wp:attachment":[{"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4068"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.aamirharoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}