Of course that delete itself is audited, which is fine. But those audit records (the ones tracking DELETE FROM AUD$) are not being deleted after 7 days. AUD$ has records of DELETE FROM AUD$ dating back to 14-July. This isn't a big problem, but I'd like to be able to explain it to myself! I think I'm have a brain freeze ... ;-)
begin delete from sys.aud$ where trunc(NTIMESTAMP# ) < trunc(sysdate -7); end;
damorgan wrote:I knew it had to be there, and thought I had read it before, but for some reason I just wasn't seeing it to confirm my doubts! Like I said ... brain freeze.
What's to explain? Oracle clearly explains this in the docs:
Note: DELETE, INSERT, UPDATE, and MERGE operations on SYS.AUD$ table are always audited. These audit records are not allowed to be deleted.