For those of you using and/or considering Unified Auditing, in case you might have missed, Oracle has made significant changes to Unified Auditing in 12.2. Unified Auditing, new in Oracle 12c, represents a complete rewrite of how native database auditing works - see the links below for Integrigy research on Unified Auditing.
With Oracle 12.1, when using Unified Auditing, reads of the UNIFIED_AUDIT_TRAIL view were not performant. With Oracle 12.2, a new relational partitioned table (AUDSYS.AUD$UNIFIED) is created to solve the performance issue, and a patch (22782757) has been issued to backport the fix to 12.1.
For 12.1 clients using Unified Auditing, the patch and/or the workaround should be a high priority consideration.
Thank you to Mark Dietrich for pointing out the 12.1 patch.
If you have any questions, please contact us at firstname.lastname@example.org
-Michael Miller, CISSP-ISSMP, CCSP, CCSK
- Oracle Support Note 2063340.1 (Performance Issues While Monitoring the Unified Audit Trail) https://support.oracle.com/rs?type=doc&id=2063340.1
- Integrigy Whitepaper: Oracle 12c Unified Auditing
- Integrigy Webinar & Presebntation: Oracle 12c Unified Auditing Webinar
- Integrigy Audit Framework Whitepaper: Integrigy Guide to Database Auditing and Logging
- Mark Dietrich's Blog: https://mikedietrichde.com/2017/04/19/unified-auditing-performance-improvements-in-oracle-12-1-0-2/