How to stop generating audit trace files for sys user??

User_KYWTC

Hi Team

My current environment is 12.1.0.2 and we are in mixed mode auditing.

We could see audit trace files are still getting generated even after making audit_sys_operations=false . Is there anyway to stop generating these trace files?

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_sys_operations                 boolean     FALSE

Audit_file_dest

=============

-rw-r-----. 1 oracle oinstall 2.1K Jun  4 13:41 REVSND00_ora_15642_20200604134058036954143795.aud

-rw-r-----. 1 oracle oinstall  724 Jun  4 13:41 REVSND00_ora_15687_20200604134125979544143795.aud

-rw-r-----. 1 oracle oinstall  728 Jun  4 13:41 REVSND00_ora_15750_20200604134126049767143795.aud

-rw-r-----. 1 oracle oinstall  731 Jun  4 13:41 REVSND00_ora_15767_20200604134130211577143795.aud

User_KYWTC

Yes, there is no way to disable the trace files as logins by sysdba/sysoper are enabled by default. But when you enable pure unified auditing mode, none of the trace files are getting generated in adump directory.

Thanks for your time.

pmdba

Logins by SYSDBA and SYSOPER users are audited by default, regardless of the AUDIT_SYS_OPERATIONS setting. I do not know of any way to disable that.

Emad Al-Mousa

what is the value of audit_trail ?

https://docs.oracle.com/cd/B19306_01/server.102/b14237/initparams016.htm#REFRN10006

you can configure a crontab job to "delete" old files based on a retention policy ....for example older than 7 days logs should be deleted, using find Linux Command.

Regards,

Emad

User_KYWTC

Yes, there is no way to disable the trace files as logins by sysdba/sysoper are enabled by default. But when you enable pure unified auditing mode, none of the trace files are getting generated in adump directory.

Thanks for your time.