Discussions
Categories
- 17.9K All Categories
- 3.4K Industry Applications
- 3.3K Intelligent Advisor
- 63 Insurance
- 536.4K On-Premises Infrastructure
- 138.3K Analytics Software
- 38.6K Application Development Software
- 5.8K Cloud Platform
- 109.5K Database Software
- 17.5K Enterprise Manager
- 8.8K Hardware
- 71.1K Infrastructure Software
- 105.3K Integration
- 41.6K Security Software
How to stop generating audit trace files for sys user??

Hi Team
My current environment is 12.1.0.2 and we are in mixed mode auditing.
We could see audit trace files are still getting generated even after making audit_sys_operations=false . Is there anyway to stop generating these trace files?
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_sys_operations boolean FALSE
Audit_file_dest
=============
-rw-r-----. 1 oracle oinstall 2.1K Jun 4 13:41 REVSND00_ora_15642_20200604134058036954143795.aud
-rw-r-----. 1 oracle oinstall 724 Jun 4 13:41 REVSND00_ora_15687_20200604134125979544143795.aud
-rw-r-----. 1 oracle oinstall 728 Jun 4 13:41 REVSND00_ora_15750_20200604134126049767143795.aud
-rw-r-----. 1 oracle oinstall 731 Jun 4 13:41 REVSND00_ora_15767_20200604134130211577143795.aud
Best Answer
-
Yes, there is no way to disable the trace files as logins by sysdba/sysoper are enabled by default. But when you enable pure unified auditing mode, none of the trace files are getting generated in adump directory.
Thanks for your time.
Answers
-
Logins by SYSDBA and SYSOPER users are audited by default, regardless of the AUDIT_SYS_OPERATIONS setting. I do not know of any way to disable that.
-
what is the value of audit_trail ?
https://docs.oracle.com/cd/B19306_01/server.102/b14237/initparams016.htm#REFRN10006
you can configure a crontab job to "delete" old files based on a retention policy ....for example older than 7 days logs should be deleted, using find Linux Command.
Regards,
Emad
-
Yes, there is no way to disable the trace files as logins by sysdba/sysoper are enabled by default. But when you enable pure unified auditing mode, none of the trace files are getting generated in adump directory.
Thanks for your time.