how to enable/disable auditing

[trogen]

How do I check whether I have auditing enabled on my system tablespace.
And how do I enable/disable it?
My system tablespace is for some odd reason running out of space and I need to find out the cause.
Any suggestions would help.
Thanks.

[ramk_vv]

Hi,

Regarding auditing commands, I feel you can go through the auditing documentation on oracle site.Generally your dba_audit_object view gets populated with records if auditding is enabled on any of your tables.The sys.aud$ stores the actual audit records.It must be periodically monitored and truncated or else your system tablespace will become full.

You may also check whether any user is having his default or temporary tablespace set to system.Whether any public rollback segments are created and are being used in the system tablespace.

[sreddy]

1.Turn on the Audit by setting init.ora parm AUDIT_TRIAL=TRUE
2. Run cataudit.sql
3. Run your custom_audit.sql(which has the action list to be audited)
4. Purge the audit on oeriodic basis after backing up the audit report files( Depending up on the requirement)


[Edited by sreddy on 03-03-2001 at 07:28 PM]

[pando]

just want to clear some stuff
You can enable audit trail at database level or os level, I guess you are interested in db level so in your init.ora set

audit_trail=db by default this is set to none

you dont really need to run cataudit.sql because when you run catalog.sql cataudit.sql is executed inside catalog.sql so all views should have been created already

Now there are three levels of audit option, first is statement then privilege and finally object level. To understand these further I suggest you to read Oracle documentation

/doc/server.816/a76989/ch4d10.htm#5602

And audit does not records the values being inserted/updated/deleted. Only the operation is recorded.
Remember truncate AUD$ every week or so since it's a table where all audit is stored and it resides in tablespace system and that's why it's recomendable to truncate it (avoid system tablespace growth). It's the only system table that can be "touched" (truncate delete etc)

HTH

[jmodic]

[QUOTE][i]Originally posted by pando [/i]
[B]Remember truncate AUD$ every week or so since it's a table where all audit is stored and it resides in tablespace system and that's why it's recomendable to truncate it (avoid system tablespace growth). It's the only system table that can be "touched" (truncate delete etc)
HTH [/B][/QUOTE]
BTW, AUD$ is also the only SYS table that is "officially" allowed to be moved out of SYSTEM tablespace into some other tablespace (togeteher with its index).