This content has been marked as final. Show 7 replies
I've created table system.aud_$$ (copy of sys.aud$).Why you you doing above job , what is a purpose
Than i created scheduled job, whitch once per day
iserts data from sys.aud$ in to system.aud_$$ table.
Do i have all records on system.aid_$$, or is itThere is possibility that you may miss some records
possible to miss some records when job is inserting
record to table and after that execute truncate
You cannot. Truncate will blow away everything in the table. To make sure you do not loose rows from AUD$, you have to delete only those rows you have archived. To use truncate and loose as few rows as possible, you will have to lock all login accounts (or take database to restricted mode) and terminate all existing sessions, archive and truncate aud$, and then open up to logins again.
This approach is not convenient if you want to perform auditing tasks, as the current information cannot be retreived from your created table. DBA_AUDIT_TRAIL as well as the other related AUDIT views are based on the SYS.AUD$. It is useless to move data so immediately. Your approach is not far from another good practice, though.
I suggest you to redefine your audit record retention policy. Keep records at the SYS.AUD$ for a predefined amount of time, let's say for two months for example, then schedule a procedure to be launched daily, this procedure will insert/delete to your table and delete from the sys.aud$ table.
This way you ensure all SYS.AUD$ records will be there by the audit views when required according to your audit policies, and you keep your audit log table trimmed.