Performance issue with query getting audit information
Ours is Oracle 12c running on a Oracle Linux 7.9. The below query started running every 30 mins in our db from Jan 1, 2023 and it has resulted in huge performance issues. The I/O from this query is incredibly high. Please see attachment for SQL monitoring snapshot. Since the general best practice suggested by Oracle is to not disable audit, we would like to understand this query better and figure out how to mitigate the problem.
SELECT TO_CHAR(current_timestamp AT TIME ZONE 'GMT', 'YYYY-MM-DD HH24:MI:SS TZD') AS curr_timestamp, SUM(failed_count) AS failed_count , TO_CHAR(MIN(first_occur_time), 'yyyy-mm-dd hh24:mi:ss') AS first_occur_time, TO_CHAR(MAX(last_occur_time), 'yyyy-mm-dd hh24:mi:ss') AS last_occur_time FROM (SELECT COUNT(db_user) AS failed_count, MIN(extended_timestamp) AS first_occur_time, MAX(extended_timestamp) AS last_occur_time FROM sys.dba_common_audit_trail WHERE action BETWEEN 100 AND 102 AND returncode != 0 AND STATEMENT_TYPE = 'LOGON' AND extended_timestamp >= current_timestamp - TO_DSINTERVAL('0 0:30:00') UNION SELECT COUNT(DBUSERNAME) AS failed_count, MIN(event_timestamp) AS first_occur_time, MAX(event_timestamp) AS last_occur_time FROM unified_audit_trail WHERE ACTION_NAME='LOGON' and return_code <> 0 AND event_timestamp >= current_timestamp - TO_DSINTERVAL('0 0:30:00'))