Oracle SYS Auditing with Audit Trail to DB

auditoracle-11g-r2

I have an Oracle Database 11g R2 on Oracle Enterprise Linux. I have enabled SYS auditing as:

SQL> ALTER SYSTEM SET audit_sys_operations=true SCOPE=spfile;

SQL> ALTER SYSTEM SET audit_trail=OS SCOPE=spfile;

SQL> SHUTDOWN IMMEDIATE

SQL> STARTUP

The audit information is storing in adump folder. But I want to set audit trail to Database(i-e: in SYS.AUD$). I have tried this:

SQL> ALTER SYSTEM SET audit_trail=DB SCOPE=spfile;

SQL> SHUTDOWN IMMEDIATE

SQL> STARTUP

but after this setting, audit records are not going to SYS.AUD$ but instead these are going to operating system adump folder. So how can I set audit trail to database?

Best Answer

This is expected behaviour SYS auditing will always go to the filesystem.

The documentation for AUDIT_FILE_DEST states:

Oracle Database also writes mandatory auditing information to this location, and if the AUDIT_SYS_OPERATIONS initialization parameter is *set, writes audit records for user SYS*.

... and the documentation for AUDIT_SYS_OPERATIONS states:

Enables or disables the auditing of top-level operations directly issued by user SYS, and users connecting with SYSDBA or SYSOPER privilege. Oracle Database writes the audit records to the audit trail of the operating system. If you set the AUDIT_TRAIL initialization parameter to XML or XML, EXTENDED, it writes the audit records in XML format. On UNIX systems, if you have also set the AUDIT_SYSLOG_LEVEL parameter, then it overrides the AUDIT_TRAIL parameter, which writes the SYS audit records to the system audit log using the SYSLOG utility.

Documentation link here.

Related Question