Skip Headers
Oracle® Audit Vault Administrator's Guide
Release 10.3

Part Number E23571-07
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

4 Administering the Oracle Audit Vault Repository

This chapter contains:

4.1 About the Administrative Tasks in This Chapter

This chapter describes important administrative tasks to perform on the Oracle Audit Vault system. These tasks are especially important if your audit data collectors are collecting high volumes of audit records and rapidly filling the default tablespace and disk space.

4.2 Monitoring the Audit Vault Server SYSAUX Tablespace Space Usage

The Oracle Audit Vault Server database contains the SYSAUX tablespace, which by default has one data file. The SYSAUX tablespace is a locally managed tablespace with automatic segment space management.

You should monitor the space usage for the SYSAUX tablespace and create additional data files for storage as needed. Remember that if you use the procedures in Section 4.10 to clean up the audit trail, the SYSAUX tablespace by default will store the audit trail.

See Oracle Database Administrator's Guide for more information about the ALTER TABLESPACE SQL statement, which you can use to add more storage data files. For information about optimizing a tablespace, see Oracle Database Performance Tuning Guide.

4.3 Monitoring Audit Vault Server Archive Log Disk Space Usage

By default, ARCHIVELOG mode is enabled in the Audit Vault Server database. The ARCHIVELOG mode copies filled online redo logs to disk. This enables you to back up the database while it is open and being accessed by users, and to recover the database to any desired point in time. You should monitor the disk space usage for the redo logs.

See Oracle Database Administrator's Guide for more information about changing the LOG_ARCHIVE_DEST_n location to relocate these archive log files to larger disks. For information about backing up the archive logs, see Oracle Database Backup and Recovery Advanced User's Guide.

4.4 Monitoring the Audit Vault Server Flash Recovery Area

By default, the Audit Vault Server database has the following initialization parameter settings:

  • The DB_RECOVERY_FILE_DEST_SIZE initialization parameter is set to 2 GB.

  • The DB_RECOVERY_FILE_DEST initialization parameter is set to the default flash recovery area, typically the ORACLE_HOME/flash_recovery_area directory.

Ensure that the size of the flash recovery area is large enough to hold a copy of all data files, all incremental backups, online redo logs, archived redo logs not yet backed up on tape, control files, and control file auto backups. This space can fill up quickly, depending on the number of collectors configured, the scope of the audit record collection being administered, and the backup and archive plans that you have in place.

You can use Oracle Enterprise Manager Database Control to monitor the available space in the flash recovery area. Monitor the percent space that is usable in the Usable Flash Recovery Area field under the High Availability section on the Home page. Check the alert log in the Database Console for messages. When the used space in the flash recovery area reaches 85 percent, a warning message is sent to the alert log. When the used space in the flash recovery area reaches 97 percent, a critical warning message is sent to the alert log.

You can manage space in the flash recovery area by adjusting the retention policy for data files to keep fewer copies or reduce the number of days these files stay in the recovery window. Alternatively, increase the value of the DB_RECOVERY_FILE_DEST_SIZE initialization parameter to accommodate these files and to set the DB_RECOVERY_FILE_DEST initialization parameter to a value where more disk space is available. See Oracle Database Administrator's Guide and Oracle Database Backup and Recovery Basics for more information.

4.5 Managing Oracle Audit Vault Backup and Recovery Operations

When you back up Oracle Audit Vault, you must back up the database, the Audit Vault Server home, and the Audit Vault collection agent home.

This section contains:

See Also:

Oracle Database Backup and Recovery Basics for more information about backing up a database.

4.5.1 Backing Up the Database

After cleanly shutting down the instance following the analysis of the database, you should perform a full backup of the database. Complete the following steps:

  1. Log in to Oracle Recovery Manager (RMAN):

    rman "target / nocatalog"
    
  2. Issue the following RMAN commands:

    BACKUP DATABASE FORMAT 'some_backup_directory%U' TAG before_upgrade;
    BACKUP CURRENT CONTROLFILE TO 'save_controlfile_location';
    

4.5.2 Backing Up Audit Vault Server Home and Audit Vault Collection Agent Home

Back up or copy the Audit Vault Server home and the Audit Vault collection agent home to separate directories.

4.6 Managing the Audit Vault Console in an Oracle RAC Configuration

When you can deploy the Oracle Audit Vault Server in an Oracle RAC configuration, the repository database can take advantage of the scalability and high availability features provided by Oracle RAC. However, the Audit Vault Console is not Oracle RAC-aware, and can only run on one node in the Oracle RAC environment. Usually, this is the node on which the first instance of Oracle Audit Vault was installed. In the event that this node becomes unavailable, the Console does not automatically fail over to another node as the repository database does. As a result, the Audit Vault Console application is no longer available to users. To remedy this problem, you must manually bring up the Audit Vault Console on another node in the Oracle RAC cluster.

To bring up the Audit Vault Console on another node in the Oracle RAC cluster:

  1. Ensure that the Audit Vault Console is not running on the main node.

    Because the node is inaccessible, this should be the case anyway. To check, run the avctl show_av_status command, described in Section 8.5.

  2. Open a shell or command prompt for the Audit Vault Server.

    • UNIX: Set the environment variables, as described in Section 2.2.2.

    • Microsoft Windows: Go to the Audit Vault Server ORACLE_HOME\bin directory.

  3. Run the avca deploy_av command to deploy the Audit Vault Console in the Oracle home.

    For example:

    avca deploy_av -sid av -dbalias av -avconsoleport 5700
    

    See Section 7.6 for more information about the avca deploy_av command.

  4. Restore the wallet.

    For each source database that has been registered with Oracle Audit Vault, Audit Vault uses a user name and password pair to connect to it. These user names and passwords are stored in an Oracle wallet on the Audit Vault Server. You can find the wallet in the $ORACLE_HOME/network/admin/avwallet directory. If you have the wallet from the original node backed up, restore it into this directory on the new node.

4.7 Using a Collection Agent to Listen to Oracle RAC Nodes

In an Oracle Real Application Clusters (Oracle RAC) environment, after you have configured the Audit Vault collection agent, the node on which the collection agent was installed has its listener set to listen only to that node. Thus, only that node can be specified to connect to. However, you can configure the listener to listen to the other nodes.

For the OSAUD and DBAUD collectors, you must update the tnsnames.ora file during installation of the Audit Vault collection agents.

After you configure the collection agent, the tnsnames.ora file located in $ORACLE_HOME/network/admin has an alias similar to the following:

AV = 
  (DESCRIPTION = 
     (ADDRESS = (PROTOCOL = TCP)(HOST = node01) (PORT = 1521))
     (CONNECT_DATA = 
       (SERVICE_NAME = avsrv.example.com))) 

For high availability, you may need to edit the Audit Vault collection agent home tnsnames.ora file after you have configured the collection agent, and then add the host and port of the other listeners.

For example:

AV = 
  (DESCRIPTION = 
     (ADDRESS = (PROTOCOL = TCP)(HOST = node01)(PORT = 1521)) 
     (ADDRESS = (PROTOCOL = TCP)(HOST = node02)(PORT = 1521)) 
     (ADDRESS = (PROTOCOL = TCP)(HOST = node03)(PORT = 1521)) 
     (ADDRESS = (PROTOCOL = TCP)(HOST = node04)(PORT = 1521)) 
     (LOAD_BALANCE = yes) 
     (CONNECT_DATA = 
       (SERVER = DEDICATED) 
         (SERVICE_NAME = avsrv.example.com) 
     ) 
   ) 

For the REDO collector, you must log in using the source user account at the source database and then re-create the database link for avsrv.example.com. The new database link can either have a list of host and port numbers or point to a tnsnames entry with the list of host and port numbers.

Follow these guidelines for OSAUD and DBAUD collectors:

  • Configuring OSAUD collectors. You must create an OSAUD collector for each Oracle RAC node. If you have a shared file system, then ensure that files from one node be kept in a separate directory than those from another node.

  • Configuring DBAUD collectors. You only need one DBAUD collector to manage all the Oracle RAC nodes. If the Oracle RAC source database is configured for failover and if one or more Oracle RAC nodes fails, then the collectors should continue to work without problems so long as at least one Oracle RAC node is working. However, if the computer where the DBAUD collector resides fails, then you can use the avorcldb alter_collector command (Section 9.4) to move the DBAUD collector to a different Oracle RAC node.

    Be aware that this automatic failover configuration works only if you have added the source database with the host name or IP address of the virtual IP address, not of each individual database instance. Suppose you have host hosta.example.com at 192.0.2.100, and host hostb.example.com at 192.0.2.101, and they are part of a cluster. The virtual IP address of the cluster is configured to 192.0.2.200, and the host name for that IP is cluster.example.com. In that case, you must run the avorcldb add_source -src cluster.oracle.com:1521:... command (See Section 9.3) to add the source database. With this method, failover is automatic. If, instead, you use hosta.example.com or hostb.example.com, then failover configuration will not work.

    Another way to handle this configuration is to add the source database with hosta.oracle.com, but then you must change the TNSNAMES.ORA file on the Audit Vault Server and the agent managing your DBAUD collector. In addition, you must add hostb.oracle.com as another address for the same TNS alias as hosta.oracle.com. This method enables the collector to failover when one of the hosts is disabled.

4.8 Configuring Collection Agent Connectivity for Oracle RAC

When you add an Oracle source database to Oracle Audit Vault, you must provide the host:port:service information for the source database being added. This information is used for the following tasks from the collection agent:

  • REDO collector: Starting and stopping the capture process on the source

  • DBAUD collector: Retrieving rows from AUD$ and FGA_LOG$ tables

  • Policy management: Retrieving source dictionary information

Typically, when the Oracle Database instance on the host goes down or if the host computer goes down, the connectivity to the source database from the Oracle Audit Vault collection agent is broken. Any attempt to perform these tasks is unsuccessful because this connection is not available:

You can do any or all of the following operations to make the connection between the source and the Audit Vault collection agent more highly available.

  • In the Audit Vault collection agent home, update the tnsnames.ora file to include additional host or port information for the service. This file is located in the $ORACLE_HOME/network/admin directory. You can add options for load balancing and failure in the connect string. For additional information, see Oracle Database Net Services Administrator's Guide.

  • Configure a listener on the Oracle RAC nodes to support connecting to remote nodes and configuring the Oracle Database to communicate with remote listeners. If the Oracle Database instance goes down, then the listener on the host can create connections on a different Oracle RAC node. For additional information, see Oracle Database Net Services Administrator's Guide.

  • Provide host information using the virtual IP address of the node instead of the physical IP address. If the host computer goes down, then all traffic to the host is redirected to a different node.

4.9 Changing the Port Numbers Used by Oracle Audit Vault

This section contains:

4.9.1 Changing Port Numbers for the Audit Vault Server

This section contains:

4.9.1.1 Changing the Audit Vault Server Listener Port Number

Changing the port numbers for the Audit Vault Server affects the agents, collectors, the Audit Vault Console Web application, and the Audit Vault command line utilities.

First, update and test the listener.ora and tnsnames.ora files for the Audit Vault Server, as follows:

  1. Open a shell or command prompt for the Audit Vault collection agent.

    • UNIX: Set the environment variables, as described in Section 2.2.3.

    • Microsoft Windows: Go to the collection agent ORACLE_HOME\bin directory.

  2. Stop the collection agent.

    For collection agents that were created in Release 10.2.3.2 and later:

    avctl stop_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl stop_oc4j
    

    Leave this shell or command prompt open.

  3. Open a shell or command prompt for the Audit Vault Server.

    • UNIX: Set the environment variables, as described in Section 2.2.2.

    • Microsoft Windows: Go to the Audit Vault Server ORACLE_HOME\bin directory.

  4. Stop the collector.

    avctl stop_collector -collname collector_name -srcname source_name
    
  5. Stop the Audit Vault Console.

    avctl stop_av
    
  6. Stop the listener on the server side.

    lsnrctl stop listener_AV_SID
    
  7. On the server side, manually edit the listener.ora and tnsnames.ora files in $ORACLE_HOME/network/admin on the server to use the new port number.

    If the port number that you want to set is not 1521, then do the following:

    • Verify that the $ORACLE_HOME/network/admin/tnsnames.ora file contains an entry for the listener. This entry is as follows; make a note of the listener_name value:

      listener_name = (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=hostname)(PORT=newport)))
      
    • Verify that the local_listener parameter in the database is set to the listener name that is defined in your tnsnames.ora file. This step ensures that the database and related services are registered with the listener.

  8. On the server side, restart the listener.

    lsnrctl start listener_AV_SID
    
  9. Edit the emoms.properties file in the $ORACLE_HOME/hostname_sid/sysman/config directory to use the listener port that Oracle Enterprise Manager connects to.

    To do so, edit the emdRepPort and emdRepConnectDescriptor properties in the emoms.properties file.

  10. Edit the PORT value in the oracle_listener and oracle_database entries in the $ORACLE_HOME/hostname_sid/sysman/emd/targets.xml file to use the new port number.

  11. From the Audit Vault Server shell, restart the Audit Vault Console and collector, and then check their status to ensure that they can connect to the source database.

    avctl start_av
    avctl start_collector -collname collector_name -srcname source_name
    
    avctl show_av_status
    avctl show_collector_status -collname collector_name -srcname source_name
    
  12. From the Audit Vault collection agent shell, restart the collection agent, and then ensure that it is running by checking its status.

    For collection agents created in Release 10.2.3.2 and later:

    avctl start_agent
    avctl show_agent_status
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl start_oc4j
    avctl show_oc4j_status
    

Next, reconfigure each Audit Vault collection agent to connect to the database, as follows:

  1. Access the shell or command prompt for the Audit Vault Server.

    • UNIX: If necessary, set the environment variables, as described in Section 2.2.2.

    • Microsoft Windows: Go to the Audit Vault Server ORACLE_HOME\bin directory.

  2. Stop each collector.

    avctl stop_collector -collname collector_name -srcname source_name
    
  3. Stop the collection agents.

    For collection agents that were created in Release 10.2.3.2 and later:

    avctl stop_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl stop_oc4j
    
  4. In the Audit Vault collection agent home, edit the entry for AV in the $ORACLE_HOME/network/admin/tnsnames.ora file to use the new port number.

  5. Restart the collection agents.

    For collection agents created in Release 10.2.3.2 and later:

    avctl start_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl start_oc4j
    
  6. From the Audit Vault Server shell, start each collector for the agent.

    avctl start_collector -collname collector_name -srcname source_name
    

4.9.1.2 Changing the Audit Vault Console and Enterprise Manager Port Number

The Audit Vault Console shares the same port with Oracle Enterprise Manager Database Control. The following procedure changes the port number for both.

To change the Audit Vault Console and Database Control port number:

  1. From the Audit Vault Server shell, run the following emca -reconfig ports commands:

    emca -reconfig ports -DBCONTROL_HTTP_PORT new_port_number 
    emca -reconfig ports -RMI_PORT new_port_number
    emca -reconfig ports -JMS_PORT new_port_number
    
  2. In the $ORACLE_HOME/hostname_sid/sysman/config directory, edit the emoms.properties file to use the new listener port that Database Control uses.

  3. Open a shell or command prompt for the Audit Vault Server.

    • UNIX: Set the environment variables, as described in Section 2.2.2.

    • Microsoft Windows: Go to the Audit Vault Server ORACLE_HOME\bin directory.

  4. Stop the Audit Vault Console.

    avctl stop_av
    
  5. Restart the Audit Vault Console.

    avctl start_av
    

4.9.1.3 Changing the Audit Vault PL/SQL Gateway Port Number

Changing the Audit Vault PL/SQL gateway port affects the Audit Vault Console only.

  1. In the Audit Vault Server shell or command prompt, ensure that the listener is running.

    lsnrctl status listener_AV_SID
    

    If the listener is not running, then start it.

    lsnrctl start listener_AV_SID
    
  2. Log in to SQL*Plus as a user who has been granted the AV_ADMIN role.

    For example:

    sqlplus tjones
    Enter password: password
    Connected.
    
  3. Run the following statements:

    SQL> EXEC DBMS_XDB.SETHTTPPORT(new_port_number);
    SQL> COMMIT;
    

4.9.2 Changing Port Numbers for the Audit Vault Collection Agents

Changing the port numbers for the Audit Vault agent affects the agents and collectors.

This section contains:

4.9.2.1 Changing the Collection Agent HTTP Port Number

Changing the HTTP port for the collection agent affects the agents and collectors only.

To change the port number for the agent HTTP connection:

  1. Open a shell or command prompt for the Audit Vault collection agent.

    • UNIX: Set the environment variables, as described in Section 2.2.3.

    • Microsoft Windows: Go to the collection agent ORACLE_HOME\bin directory.

  2. Stop the collection agents.

    For collection agents that were created in Release 10.2.3.2 and later:

    avctl stop_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl stop_oc4j
    
  3. In the $ORACLE_HOME/oc4j/j2ee/home/config/http-web-site.xml file, edit the web-site port entry to use the new port number.

  4. Restart the collection agents.

    For collection agents created in Release 10.2.3.2 and later:

    avctl start_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl start_oc4j
    
  5. Log in to Audit Vault Console as a user who has been granted the AV_ADMIN role.

  6. Navigate to the Configuration page, then select the Agent tab.

  7. Select the agent for which you changed the port.

  8. Click the Edit button.

  9. In the Port Number field, enter the new port number.

  10. Click OK to update the port number for this agent in the Audit Vault Server.

4.9.2.2 Changing the Collection Agent RMI and JMS Port Numbers

Changing the collection agent RMI and JMS port numbers affects the agents only.

To change the collection agent RMI and JMS port numbers:

  1. Open a shell or command prompt for the Audit Vault collection agent.

    • UNIX: Set the environment variables, as described in Section 2.2.3.

    • Microsoft Windows: Go to the collection agent ORACLE_HOME\bin directory.

  2. Stop the collection agents.

    For collection agents that were created in Release 10.2.3.2 and later:

    avctl stop_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl stop_oc4j
    
  3. In the $ORACLE_HOME/oc4j/j2ee/home/config/rmi.xml file, edit the rmi-server port setting to use the new port number for the RMI port.

  4. In the $ORACLE_HOME/oc4j/j2ee/home/config/jms.xml, edit the jms-server port to use the new port number for the JMS port.

  5. Restart the collection agents.

    For collection agents created in Release 10.2.3.2 and later:

    avctl start_agent
    

    For Release 10.2.3.1 or earlier collection agents that have not yet been upgraded:

    avctl start_oc4j
    

4.9.3 Changing Port Numbers for the Oracle Source Database

Changing the port number for the Oracle source database affects the Audit Vault collectors.

First, change the port number for the source database listener:

  1. Open a shell or command prompt for the Audit Vault Server.

    • UNIX: Set the environment variables, as described in Section 2.2.2.

    • Microsoft Windows: Go to the Audit Vault Server ORACLE_HOME\bin directory.

  2. Stop each collector that is running against this source database.

    avctl stop_collector -collname collector_name -srcname source_name
    
  3. Shut down the listener.

    lsnrctl stop listener_AV_SID
    
  4. Use Oracle Net Configuration Assistant to change the port number.

    From $ORACLE_HOME/bin, enter the following command to start Net Configuration Assistant:

    netac
    
  5. Restart the listener.

    lsnrctl start listener_AV_SID
    
  6. Do not close this shell.

Next, follow these steps:

  1. Update the source database port number.

    From the Audit Vault Server, run the following command:

    avorcldb alter_source -srcname source_name PORT=new_port_number
    

    Alternatively, use the Audit Vault Console to change the source database port number.

  2. From the collection agent shell, update the port number in the tnsnames.ora file.

    avorcldb setup -srcname source_database
    Enter Source user name: username
    Enter Source password: password
    

    Alternatively, edit the port number for the source database in the tnsnames.ora file in the $ORACLE_HOME/network/admin directory.

  3. From the Audit Vault Server shell, start each collector the agent.

    avctl start_collector -collname collector_name -srcname source_name
    
  4. On the Audit Vault Server, update the port number in the file $ORACLE_HOME/network/admin/tnsnames.ora for the source database.

4.10 Purging the Oracle Source Database Audit Trail

This section contains:

4.10.1 About Purging the Oracle Source Database Audit Trail

When you add an Oracle source database from Releases 10.2.0.3 through 11.2 with Oracle Audit Vault, you can use the DBMS_AUDIT_MGMT PL/SQL package to purge the database audit trail. This feature does not apply to Oracle Database 9i Release 2 (9.2) source databases.

The DBMS_AUDIT_MGMT package enables you to perform audit trail cleanup tasks such as scheduling purge jobs, moving the audit trail to a different tablespace, setting archive timestamps in the audit trail, and so on. You must have the EXECUTE privilege for DBMS_AUDIT_MGMT before you can use it.

By default, Oracle Database 11g Release 2 (11.2) has the DBMS_AUDIT_MGMT package and its associated data dictionary views installed. If your source database is from Release 10.2.0.3 through 11.1.0.7, then you can download the DBMS_AUDIT_MGMT package and data dictionary views from My Oracle Support, from the following Web site:

https://support.oracle.com

Search for Article ID 731908.1.

To create an automated purge job in an Oracle Audit Vault environment, see Section 4.10.2.

For details about using the DBMS_AUDIT_MGMT PL/SQL package and views, refer to the following Oracle Database 11g Release 2 (11.2) documentation:

4.10.2 Scheduling an Automated Purge Job for an Oracle Audit Vault Environment

Oracle Audit Vault is integrated with the DBMS_AUDIT_MGMT package on a source database. This integration automates the purging of audit records from the AUD$ and FGA_LOG$ files, and from the operating system .aud and .xml files after they have been successfully inserted into the Audit Vault repository by the Audit Vault collector. After the purge is completed, the collectors automatically set a timestamp on audit data that has been collected. Therefore, you must set the USE_LAST_ARCH_TIMESTAMP property to true to ensure that the right set of audit records are purged. You do not need to manually set a purge job interval.

To schedule an automated purge job for an Audit Vault source Oracle database:

  1. Log in to SQL*Plus on the source database as a user who has been granted the EXECUTE privilege for the DBMS_AUDIT_MGMT PL/SQL package.

    For example:

    sqlplus tjones
    Enter password: password
    
  2. Initialize the audit trail cleanup operation.

    In the following example, the DEFAULT_CLEANUP_INTERVAL setting runs the job every two hours:

    BEGIN
     DBMS_AUDIT_MGMT.INIT_CLEANUP(
      AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
      DEFAULT_CLEANUP_INTERVAL    => 2 );
    END;
    /
    
  3. Verify that the audit trail is initialized for cleanup.

    For example:

    SET SERVEROUTPUT ON
    BEGIN
     IF
       DBMS_AUDIT_MGMT.IS_CLEANUP_INITIALIZED(DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL)
     THEN
       DBMS_OUTPUT.PUT_LINE('Database and OS audit are initialized for cleanup');
     ELSE
       DBMS_OUTPUT.PUT_LINE('Database and OS audit are not initialized for cleanup.');
     END IF;
    END;
    /
    
  4. Use the DBMS_AUDIT_MGMT.CREATE_PURGE_JOB procedure to create and schedule the purge job.

    In this procedure, ensure that you set the USE_LAST_ARCH_TIMESTAMP property to TRUE, so all records older than the timestamp can be deleted.

    The following procedure creates a purge job called CLEANUP_OS_DB_AUDIT_RECORDS that will run every two hours to purge the audit records.

    BEGIN
      DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (
       AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
       AUDIT_TRAIL_PURGE_INTERVAL  => 2,
       AUDIT_TRAIL_PURGE_NAME      => 'CLEANUP_OS_DB_AUDIT_RECORDS',
       USE_LAST_ARCH_TIMESTAMP     => TRUE );
    END;
    /
    

See Oracle Database PL/SQL Packages and Types Reference for detailed information about the DBMS_AUDIT_MGMT PL/SQL package.

4.11 Purging the Oracle Audit Vault Repository Audit Trail

By default, the audit trail generated by the Oracle Audit Vault repository is purged every 24 hours. If you want, you can change these purge settings, or to disable purging altogether. (You may want to disable the purge settings if you are using a different purge utility.) For information about purging the audit trail, see the list of documentation references in Section 4.11.

Note the following:

  • The AUDIT_TRAIL initialization parameter in the Audit Vault Server database is set to DB, which means that the audit trail is written to the database AUD$ system table. You can set the audit trail to any valid AUDIT_TRAIL initialization parameter setting. (However, you cannot modify the Oracle Database Vault audit trail setting, which is always DB.)

  • Because Oracle Database Vault is enabled, the AUD$ system table resides in the SYSTEM schema. The synonym SYS.AUD$ is created to refer to the SYSTEM.AUD$ table. (Oracle strongly recommends that you do not disable Oracle Database Vault.)