New Security Features in 12C - Protecting Oracle Database 12c - page 69

The following query confirms that by default the new unified auditing is actually turned off in 12c:

SQL> select con_id,parameter,value
2 from v$option
3 where parameter = 'Unified Auditing';

CON_ID PARAMETER Value
---------- ---------------- --------------
0 Unified Auditing FALSE

unified_audit_trail is just acting as a view on the previous audit trails, providing the centralized view, which is
great, but by default the underlying Oracle audit-trail format has not been changed to SecureFiles, which is very good
news for folks like me who like to go in and read the audit-trail entries.
So, some of the pre-12c release concerns have been heeded by Oracle. We still have our flat-file, *nix-friendly
audit entries. The DB-based location for audit entries is now in SYSAUX, and entries are queued in the SGA, which
makes DB-based audit entries more performant. The added performance enables auditing to be kept on permanently.
Additionally, the unified_audit_trail view does contain a new column to record incoming dblink information.
The new column is named dblink_info , and you can see it in the following example:

select dblink_info
from UNIFIED_AUDIT_TRAIL
where dblink_info is not NULL;

SOURCE_GLOBAL_NAME=orcl.enterprise.internal.city.ac.uk, DBLINK_NAME=TEST.ENTERPRISE.INTERNAL.CITY.
AC.UK, SOURCE_AUDIT_SESSIONID=57645

The new functionality for auditing includes two new roles devised to administrate and view the audit trail, namely:

AUDIT_ADMIN •

AUDIT_VIEWER

•

The actions that are audited are contained within an audit policy, and those policies are administered using the
following system privileges held by the above roles. These actions are:

CREATE AUDIT POLICY

•

ALTER AUDIT POLICY •

DROP AUDIT POLICY •

Improvements include the ability to audit all role actions with a single statement. Below is an example of creating
an audit policy and turning it on. Two separate commands are used.

SQL> CREATE AUDIT POLICY dba_pol ROLES DBA CONTAINER = ALL;

Audit policy created.

SQL> AUDIT POLICY dba_pol;

Audit succeeded.