Audit Process

When you turn on auditing, the database server generates audit records for every event that the auditing instructions specify, as Figure 3 shows. For UNIX, specify whether the operating system or the database server manages the audit records. For details, see Types of Auditing.

If you use database server-managed auditing, the database server stores the audit records in a file called an audit file, as Figure 3 shows. The collection of audit records makes up the audit trail. (The audit trail might consist of more than one audit file.) When operating-system-managed auditing is used on UNIX, the records are stored in an operating-system audit trail.

Figure 3. The Audit Process

An audit administrator needs to specify and maintain the audit configuration, which includes the following information:

• The audit mode
• How the database server behaves if it encounters an error when writing audit records to the audit trail
• For UNIX, the directory in which the audit trail is located
• For UNIX, the maximum size of an audit file before the database server or operating system automatically starts another audit file

These topics are explained in Audit Configuration.

The database server generates audit records and writes them to the audit file or to an event log regardless of whether the client user that performs the audited action is local or remote. The database server includes both the user login and database server name in every audit record to help pinpoint a specific initiator and action.