Oracle Database auditing with Oracle unified auditing

Advantages

• Single unified audit trail, simplifies managing multiple audit trails.
• Predefined audit policies which may be useful out of the box.
• Easily create audit policies to suit your company’s auditing requirements.
• Auditing performance is improved for both reads and writes (12.2+).  Performance impacts are lower than traditional auditing.
• Once enabled unified auditing is always on, no more needing to set different initialization parameters.

Recommendations

• Keep unified auditing in a separate tablespace.
• Consider a retention policy for your auditing information.
• Target auditing that is required only, collecting unnecessary audit information increases impacts on performance and increases storage use.

Some handy SQL to check whether Unified Auditing is enabled and currently in use:

Determine whether unified auditing is enabled within the database:

SELECT value from v$option where parameter = ‘Unified Auditing’;

Checking which policies are enabled:

SELECT policy_name, enabled_opt, user_name FROM audit_unified_enabled_policies

Check the default policies and conditions for pre-defined policies ORA_SECURECONFIG and ORA_LOGON_FAILURES:

SELECT policy_name,audit_option,condition_eval_opt,audit_condition FROM audit_unified_policies WHERE  policy_name in (‘ORA_SECURECONFIG’,’ORA_LOGON_FAILURES’) order by 1;