Manually Purging the Audit Trail

You can use the DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL procedure to manually purge the audit trail.

• About Manually Purging the Audit Trail
  You can manually purge the audit trail right away, without scheduling a purge job.

• Using DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL to Manually Purge the Audit Trail
  After you complete preparatory steps, you can use the DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL procedure to manually purge the audit trail.

About Manually Purging the Audit Trail

You can manually purge the audit trail right away, without scheduling a purge job.

Similar to a purge job, you can purge audit trail records that were created before an archive timestamp date or all the records in the audit trail. Only the current audit directory is cleaned up when you run this procedure.

For upgraded databases that may still have audit trails from earlier releases, note the following about the DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL PL/SQL procedure:

• On Microsoft Windows, because the DBMS_AUDIT_MGMT package does not support cleanup of Windows Event Viewer, setting the AUDIT_TRAIL_TYPE property to DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS has no effect. This is because operating system audit records on Windows are written to Windows Event Viewer. The DBMS_AUDIT_MGMT package does not support this type of cleanup operation.

• On UNIX platforms, if you had set the AUDIT_SYSLOG_LEVEL (deprecated) initialization parameter, then Oracle Database writes the operating system log files to syslog files. (Be aware that when you configure the use of syslog files, the messages are sent to the syslog daemon process. The syslog daemon process does not return an acknowledgment to Oracle Database indicating a committed write to the syslog files.) If you set the AUDIT_TRAIL_TYPE property to DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS, then the procedure only removes .aud files under audit directory (This directory is specified by the AUDIT_FILE_DEST (deprecated) initialization parameter).

Using DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL to Manually Purge the Audit Trail

After you complete preparatory steps, you can use the DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL procedure to manually purge the audit trail.

1. If you have set the AUDIT_SYSLOG_LEVEL (deprecated) initialization parameter so that the audit trail will be written to operating system log files (syslog), then check for the following:

   • Ensure that no one is currently writing to the audit trail files.

   • Ensure that the session ID that is associated with the audit trail files is not owned by the PMON process. Restart the database if this is true before purging the audit trail.

   If either of these conditions is true, then the audit trail cannot be purged.

2. Perform the following scheduling tasks:

   • If necessary, tune the online and archive redo log sizes.

   • Plan a timestamp and archive strategy.

   • Optionally, set an archive timestamp for the audit records.

3. Connect to the root or to the PDB in which you created the purge job.

   If you created the purge job in the root, then you must log into the root. If you created the purge job in a specific PDB, then log into that PDB.

4. Purge the audit trail records by running the DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL PL/SQL procedure.

   For example:

   BEGIN
     DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
      AUDIT_TRAIL_TYPE           =>  DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
      USE_LAST_ARCH_TIMESTAMP    =>  TRUE,
      CONTAINER                  =>  DBMS_AUDIT_MGMT.CONTAINER_CURRENT,
      DROP_PARTITION_ONLY        =>  FALSE );
   END;
   /

In this example:

• AUDIT_TRAIL_TYPE: Specifies the audit trail type. DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED sets it for the unified audit trail.

  For upgraded databases that still have audit data from previous releases, use the following settings.Traditional auditing is desupported in Oracle AI Database 26ai. Oracle recommends that you use unified auditing.

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD: Standard audit trail table, AUD$. (This setting does not apply to read-only databases.)

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_FGA_STD: Fine-grained audit trail table, FGA_LOG$. (This setting does not apply to read-only databases.)

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_DB_STD: Both standard and fine-grained audit trail tables. (This setting does not apply to read-only databases)

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS: Operating system audit trail files with the .aud extension. (This setting does not apply to Windows Event Log entries.)

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_XML: XML Operating system audit trail files.

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_FILES: Both operating system and XML audit trail files.

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL: All audit trail records, that is, both database audit trail and operating system audit trail types. (This setting does not apply to read-only databases.)

  To purge records from the AUDSYS.AUD$UNIFIED table or from the operating system spillover files:

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED_TABLE purges records from the AUDSYS.AUD$UNIFIED table.

  • DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED_FILES purges records from the operating system spillover files in each database (primary or standby).

• USE_LAST_ARCH_TIMESTAMP: Enter either of the following settings:

  • TRUE: Deletes audit records created before the last archive timestamp. The default (and recommended) value is TRUE. Oracle recommends that you set USE_LAST_ARCH_TIMESTAMP to TRUE.

  • FALSE: Deletes all audit records without considering last archive timestamp. Be careful about using this setting, in case you inadvertently delete audit records that should not have been deleted.

• CONTAINER: Applies the cleansing to either the current PDB or to all PDBs. DBMS_AUDIT_MGMT.CONTAINER_CURRENT specifies the current PDB; DBMS_AUDIT_MGMT.CONTAINER_ALL applies to all PDBs.

• DROP_PARTITION_ONLY: Specifies whether CLEAN_AUDIT_TRAIL skips row deletion and drops only eligible partitions of the unified audit trail table (AUDSYS.AUD$UNIFIED). This parameter applies only when AUDIT_TRAIL_TYPE specifies the unified audit trail.

  • FALSE deletes all audit records created before the last archive timestamp, subject to the other parameter values. Use this value when cleanup must remove all audit records created before the last archive timestamp.

  • TRUE skips row-by-row deletion and drops only partitions of AUDSYS.AUD$UNIFIED that are before the last archive timestamp. This can improve cleanup performance significantly. However, audit records that are older than the last archive timestamp can remain in the current partition after cleanup.

Related Topics

• Step 1: Ensure Online and Archive redo Log Sizes Are Tuned Appropriately

• Step 2: Optionally, Set an Archive Timestamp for Audit Records