Oracle 12c Unified Auditing - Pure Mode
Continuing our blog series on Oracle 12 Unified Auditing is a discussion of Pure Mode. Mixed mode is intended by Oracle to introduce Unified Auditing and provide a transition from the traditional Oracle database auditing. Migrating to PURE Unified Auditing requires the database be stopped, the Oracle binary linked to uniaud_on, and then restarted. This operation can be reversed if auditing needs to be changed back to Mixed Mode.
When changing from Mixed to pure Unified Audit, two key changes occur. The first is the audit trails are no longer written to their traditional pre-12c audit locations. Auditing is consolidated into the Unified Audit views and stored using Oracle SecureFiles. Oracle Secured Files use a proprietary format which means that Unified Audit logs cannot be viewed using editors such vi and may preclude or affect the use of third party logging solutions such as Splunk or HP ArcSight. As such, Syslog auditing is not possible with Pure Unified Audit.
|
Unified Audit Mixed vs. Pure Mode Audit Locations |
||
|---|---|---|
|
System Tables |
Mixed Mode |
Pure Unified Audit Impact |
|
SYS.AUD$ |
Same as 11g |
Exists, but will only have pre-unified audit records |
|
SYS.FGA_LOG$ |
Same as 11g |
Exists, but will only have pre-unified audit records |
The second change is that the traditional audit configurations are no longer used. For example, traditional auditing is largely driven by the AUDIT_TRAIL initialization parameter. With pure Unified Audit, the initialization parameter AUDIT_TRAIL is ignored.
|
Unified Audit Mixed vs. Pure Mode Audit Configurations |
||
|---|---|---|
|
System Parameters |
Mixed Mode |
Pure Unified Audit Impact |
|
AUDIT_TRAIL |
Same as 11g |
Exists, but will not have any effect |
|
AUDIT_FILE_DEST |
Same as 11g |
Exists, but will not have any effect |
|
AUDIT_SYS_OPERATIONS |
Same as 11g |
Exists, but will not have any effect |
|
AUDIT_SYSLOG_LEVEL |
Same as 11g |
Exists, but will not have any effect |
|
UNIFIED_AUDIT_SGA_QUEUE_SIZE |
Same as 11g |
Yes |
If you have questions, please contact us at mailto:info@integrigy.com
Reference
- Integrigy Oracle 12c Unified Auditing Whitepaper Oracle 12c Unified Auditing
- Oracle Securefile format http://www.oracle.com/technetwork/database/features/secure-files/securefiles-160920.html
- Pure vs. Mixed Unified Audit impact on audit configurations, see table G-1 http://docs.oracle.com/database/121/DBSEG/audit_changes.htm#DBSEG341
- “How To Enable The New Unified Auditing In 12c?” Note ID 1567006.1, Oracle Corporation, 23 August 2013, https://support.oracle.com/rs?type=doc&id=1567006.1
