Oracle limit the number of files of audit

In Oracle 12c Mixed Mode is enabled by default which makes the use familiar with Unified Auditing prior to switching to full Unified Auditing. Mixed Mode allows to pre-12c audit functionality to co-exist with new Unified Auditing functionality.

Using Mixed Mode audit data can be found both in the traditional locations as well as in SYS.UNIFIED_AUDIT_TRAIL. This is because the Unified Auditing Policy ORA_SECURECONFIG is enabled by default.

You can use the following commands to disable Unified Audit.

NOAUDIT POLICY ORA_SECURECONFIG; noaudit policy ORA_LOGON_FAILURES;

Unified Auditing is not included in the Oracle 12c kernel so you have enable to manually. But in Mixed Mode it is on though it is not included in the kernel. You can check whether the Unified Auditing is enabled or not using the following query.

select VALUE from V$OPTION where PARAMETER='Unified Auditing'; If you wish to linked the Unified Auditing to kernel then use the following commands.

cd $ORACLE_HOME/rdbms/lib make -f ins_rdbms.mk uniaud_on ioracle ORACLE_HOME=$ORACLE_HOME

If you dont set AUDIT_TRAIL=NONE then both auditing mechanisms will run concurrently.

Reference

Link to Oracle Official Documentation.

Mixed Mode Auditing

The os_username is the name of the user that runs the application. The username is the name of the user defined in the database.

Suppose that UserA is logged on his desktop as UserA and runs an application to modify the data. When he is asked to connect he enters the credentials of UserB. In the audit you will find UserA as os_username and UserB as username.

This explains while you find oracle as os_username since this is the user that is used to run Oracle itself.