Question on Auditing 12C

auditoracleoracle-12c

I have the following configuration information: 

audit_sys_operations                                                            
TRUE   

audit_file_dest                                                                 
D:\ORACLE\ADMIN\DBSERVER\ADUMP  

audit_trail                                                                     
DB                                                                              

SQL> spool off;

This tells me that audit data for the SYS user is being saved in a database file. If the SYS user has full access to DB, does this not defeat the purpose of audit SYS files being stored on the DB server?

Best Answer

AUDIT_SYS_OPERATIONS

The audit records are written to the operating system's audit trail.

SYS audit entries are not stored in the database, but on the host in text files (or the event log on Windows).

But yes, you are correct, if you are SYS, you have full access to the database, and the host, with the user the database runs as. So yes, you can manipulate audit rules and data as well.

For that reason (and performance-wise), usually I suggest using AUDIT_SYSLOG_LEVEL, and configuring syslog to forward all entries to a remote server.

Related Question