I have such problem.
On my test 11.2 DB I switched on Standart Oracle Audit:
I have test user TESTAUD with "GRANT CREATE TABLE TO TESTAUD;"
Then I issued from user SYS:
SQL> audit create table;
And from user TESTAUD:
SQL> create table .....bla bla bla;
Then I looked into view DBA_COMMON_AUDIT_TRAIL. It was nothiing except actions 100 (LOGIN), 101 (LOGOFF) about user TESTAUD.
As it's test DB, I reboot it again. Looked into DBA_COMMON_AUDIT_TRAIL, and what a mirracle - there was 1row with statement_type=CREATE TABLE!!!
Then I repeat my experiment.
From user TESTAUD I created new table. Then wait 10minutes. No more rows in DBA_COMMON_AUDIT_TRAIL. I reboot DB. And looked in view. And there were 2 rows with "CREATE TABLE"!!!
What's the matter????
Do I do something wrong?
it looks like the auditing took place but the xml file may not have been immediately flushed to disk,
something that would then happen after a reboot as you observed, when the audit file is not
yet flushed other sessions checking DBA_COMMON_AUDIT_TRAIL (which for the XML part
will dynamically list the files in the audit_file_dest) will not see it.
If you want audit info to be flushed to the XML files immediately, issue:
ALTER SYSTEM SET
EVENT='46349 trace name context forever, level 1'
COMMENT='re-enable flush of audit files' SCOPE=SPFILE;
Reference: note 1358183.1 Audit Files Are Not Immediately Flushed To Disk
Please note we are currently actively promoting the new support communities also, so if you want to get some
feedback from your peers as well as the attention of Oracle support engineers, please go to
This will put you in the Database Products Security community , but you can select others also from the left,
Harm ten Napel