12c Unified Auditing (12c New Features)

Unified Audit (12c New Features)
-------------------------------------------
new parameter:
UNIFIED_AUDIT_SGA_QUEUE_SIZE (1 MB to 30MB) is introduced.
This parameter configures the size of SGA queue for unified auditing.
UNIFIED AUDIT:
-----------------------
QUEUED Mode (default). Audit records stored in the SGA and periodically flushed.
Immediate: Audit records written immediately.
Roles:
-------
 AUDIT_ADMIN and AUDIT_VIEWER to administer unified auditing.

Create auditing policy
-----------------------
SQL> create audit policy mono_audit
  privileges
   alter database, select any table
  actions
   logon, select on HR.employees;  2    3    4    5 
Audit policy created.

SQL> audit policy mono_audit;
Audit succeeded.

ENABLE AUDIT POLICY
---------------------------------
enable audit for all users
SQL>  audit policy  mono_audit ;
Audit succeeded.

Check Audit :
-----------------------
SQL> select POLICY_NAME,AUDIT_CONDITION from audit_unified_policies where POLICY_NAME like '%MONO%';
POLICY_NAME   AUDIT_CONDITION
---------------------------------------------------
MONO_AUDIT         NONE

Check Enable Audit Policy
----------------------------------
select policy_name,user_name from audit_unified_ENABLED_POLICIES ;
SQL>
POLICY_NAME          USER_NAME
--------------------------------
MONO_AUDIT         TEST
ORA_SECURECONFIG        ALL USERS
MONO_AUDIT  ALL USERS

Manual Flush
-------------------
if the audit trail mode is set to QUEUED, then audit records are not written to disk till the time memory queues become full.
SQL>  EXEC DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL;
PL/SQL procedure successfully completed.

View audit trail records
--------------------------
Data is stored in the AUDSYS schema and SYSAUX tablespace.
SQL>  alter system set audit_trail=XML scope=spfile;
System altered.
SQL> SELECT  SCN, SQL_TEXT FROM UNIFIED_AUDIT_TRAIL where DBUSERNAME='SYS' and sql_text like 'alter system%';
       SCN SQL_TEXT
---------- --------------------------------------------------------------------------------
   1732822 alter system set audit_trail=XML scope=spfile

DISABLE POLICY
------------------
SQL> NOAUDIT POLICY mono_audit;
Noaudit succeeded.

DROP POLICY
------------
SQL> DROP AUDIT POLICY mono_audit;
Audit Policy dropped.