-
1. Re: Can record in sys.aud$ be deleted directly?
Yes. it's safe to do so. You can even truncate it. Audit trail is enabled by default in 11g.1 person found this helpful -
2. Re: Can record in sys.aud$ be deleted directly?
Use the DBMS_AUDIT_MGMT.CREATE_PURGE_JOB procedure to setup an automatic purge job.1 person found this helpful
See http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_audit_mgmt.htm#BABFJHCB
Hemant K Chitale -
3. Re: Can record in sys.aud$ be deleted directly?
I set the archive timestamp with dbms_audit_mgmt.set_last_archive_timestamp but I find the it is not changed after the job set by DBMS_AUDIT_MGMT.CREATE_PURGE_JOB have been run. Do I miss anything?
BEGIN
DBMS_AUDIT_MGMT.INIT_CLEANUP(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
DEFAULT_CLEANUP_INTERVAL => 24);
END;
/
BEGIN
DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
LAST_ARCHIVE_TIME => TO_TIMESTAMP('27-Jan-12 16:00:01.000000', 'DD-Mon-RR HH24:MI:SS.FF'));
END;
/
BEGIN
DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
AUDIT_TYPE_PURGE_INITVAL => 24,
AUDIT_TRAIL_PURGE_NAME => 'Standard_Audit_Trail_PJ',
USE_LAST_ARCH_TIMESTAMP => TRUE);
END;
/ -
4. Re: Can record in sys.aud$ be deleted directly?
I have some additional question about the automatic purging audit trail records -
5. Re: Can record in sys.aud$ be deleted directly?
The last_arch_timestamp is used by the procedure but needs to be set manually by the DBA. You could have another procedure incrementally set it.
Hemant K Chitale -
6. Re: Can record in sys.aud$ be deleted directly?
As Hemant pointed out, you should set last archive timestamp dynamically. For example run this procedure every day.1 person found this helpful
BEGIN sys.DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP( audit_trail_type => sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD, last_archive_time => systimestamp - interval '30' day); END; / -
-
8. Re: Can record in sys.aud$ be deleted directly?
Hi fellows,
i have to implement this purge in audition.
Did You had to use these 3 procedures to make it right ?
I am planning to delete all records older than 30 days: delete from sys.aud$ where ntimestamp# < sysdate - 30;
And then i put it in a procedure, and then schedule it.
Does DBMS_AUDIT_MGMT works better than deleting from sys.aud$ ? i know that truncate sys.aud$ works better than deleting.
Thanks
Edited by: BrunoSales on 15/05/2012 13:43 -
9. Re: Can record in sys.aud$ be deleted directly?
This thread is already answered.
>
i have to implement this purge in audition.
>
If you have a question open a new thread for it.
If relevant you can reference this thread from your new one.
Not only is is inappropriate to hijack a thread for your own question you will get more help in a thread of your own. A lot of the forum members that could help you won't bother looking at threads that have already been answered and won't even see your question.
Thanks. -
10. Re: Can record in sys.aud$ be deleted directly?
Fine, i think it would be pretty much easier for me, once the dbms packages is already explained in the topic.
I did not knew that is inappropriate to 'hijack' a thread. But if it is the only way to get a hint about this, looks like i'll have to open a new one.