How Oracle Audit Vault Server and Agent Work

Audit Collection Plug-ins retrieve audit data in the form of audit trails, which are sequences of audit records.

Audit Collection Plug-ins retrieve audit data in the form of audit trails, which are sequences of audit records. Audit trails are generated by different target types and stored in database tables or XML audit records.

A target can write one or more audit trails; each audit trail is stored in a separate location, and can have its own format.

To elaborate a little on these terms:

• Target

  A target is a software component which generates an audit trail. A target is an instance of a target type and has specific properties such as connection credentials and trail types.

• Target Type

  A target type represents a collection of a particular type of target that generates the same type of audit data. Oracle Database, for example, is a target type which can have many instances. However, all Oracle Databases generate the same audit data and record the same fields.

• Audit Trail

  An Audit Trail identifies a location and format where audit data resides. Each audit trail is generated by one and only one target. Examples of audit trails are:

  • For targets that write data into files, the trail is the directory path plus the file mask.

  • For targets that write audit data into a database table, the name of the table is the trail for that target. Unified_Audit_Trail is an example of a database table audit trail in an Oracle database.