V$XML_AUDIT_TRAIL

V$XML_AUDIT_TRAIL shows standard, fine-grained, SYS, and mandatory audit records written in XML format files.

Note: This view is deprecated and applies only to traditional auditing. Traditional auditing is desupported starting in Oracle AI Database 26ai. Though traditional auditing is desupported, any current traditional audit settings that you have will still be honored and are viewable with this view. See Oracle AI Database Security Guide for more information about how this desupport works.

Column Datatype Description
AUDIT_TYPE NUMBER

Type of audit row:

  • 1 = Standard XML Audit

  • 2 = Fine Grained XML Audit

  • 4 = SYS XML Audit

  • 8 = Mandatory XML Audit
SESSION_ID NUMBER Numeric ID for the Oracle session
PROXY_SESSIONID NUMBER Proxy session serial number, if an enterprise user has logged in through a proxy mechanism
STATEMENTID NUMBER Numeric ID for the statement run (a statement may cause multiple audit records)
ENTRYID NUMBER Numeric ID for the audit trail entry in the session
EXTENDED_TIMESTAMP TIMESTAMP(6) WITH TIME ZONE Timestamp of the audited operation (the timestamp of the user’s logon for entries is created by AUDIT SESSION)
GLOBAL_UID VARCHAR2(32) Global user identifier for the user, if the user has logged in as an enterprise user
DB_USER VARCHAR2(128) Database username of the user whose actions were audited
CLIENTIDENTIFIER VARCHAR2(64) Client identifier in the Oracle session
EXT_NAME VARCHAR2(1024) User’s external name
OS_USER VARCHAR2(128) Operating system logon user name of the user whose actions were audited
OS_HOST VARCHAR2(128) Client host system name
OS_PROCESS VARCHAR2(16) Operating system process identifier of the Oracle server process
TERMINAL VARCHAR2(30) Identifier for the user’s terminal
INSTANCE_NUMBER NUMBER Instance number as specified by the INSTANCE_NUMBER initialization parameter
OBJECT_SCHEMA VARCHAR2(128) Owner of the audited object
OBJECT_NAME VARCHAR2(128) Name of the object affected by the action
POLICY_NAME VARCHAR2(128) Name of the fine-grained auditing policy
NEW_OWNER VARCHAR2(128) Owner of the object named in the NEW_NAME column
NEW_NAME VARCHAR2(128) New name of object after renaming, or the name of an underlying object (for example, CREATE INDEX owner.obj_name ON new_owner.new_name)
ACTION NUMBER Numeric code for the action type
STATEMENT_TYPE NUMBER Description of the action
TRANSACTIONID RAW(8) Identifier of the transaction in which the object is accessed or modified
RETURNCODE NUMBER Oracle error code generated by the action. Zero if the action succeeded.
SCN NUMBER System change number (SCN) of the query
COMMENT_TEXT VARCHAR2(4000)

Text comments on standard audit entries. Also indicates how the user was authenticated - the method can be one of the following:

  • DATABASE - authentication was done by password

  • NETWORK - authentication was done by Oracle Net Services or the Advanced Networking Option

  • PROXY - the client was authenticated by another user. The name of the proxy user follows the method type.

AUTH_PRIVILEGES VARCHAR2(34)

Privileges granted or revoked by a GRANT or REVOKE statement recorded for standard audit trail entry

The value of this column is a 34-character string of Y and dash (-) characters. Each character corresponds to a numbered privilege in the following list. The left-most character corresponds to privilege 0, the next character corresponds to privilege 1, and so on. The right-most character corresponds to privilege 33.

  • 0 - ALTER
  • 1 - AUDIT
  • 2 - COMMENT
  • 3 - DELETE
  • 4 - GRANT
  • 5 - INDEX
  • 6 - INSERT
  • 7 - LOCK
  • 8 - CREATE
  • 9 - SELECT
  • 10 - UPDATE
  • 11 - REFERENCES
  • 12 - EXECUTE
  • 13 - VIEW
  • 14 - DROP
  • 15 - ANALYZE
  • 16 - CREATE
  • 17 - READ
  • 18 - WRITE
  • 19 - KEEP SEQUENCE
  • 20 - ENQUEUE
  • 21 - DEQUEUE
  • 22 - UNDER
  • 23 - ON COMMIT
  • 24 - REWRITE
  • 25 - UPSERT
  • 26 - DEBUG
  • 27 - FLASHBACK
  • 28 - MERGE
  • 29 - USE
  • 30 - FLASHBACK ARCHIVE
  • 31 - DIRECTORY EXECUTE
  • 32 - SIGN
  • 33 - COLLECT DEBUG INFO

A Y indicates that the privilege was granted or revoked by the statement. A dash indicates that the privilege was not affected by the statement. For example, the following value indicates that the MERGE privilege was granted or revoked by the statement:

----------------------------Y-----
GRANTEE VARCHAR2(128) User who granted or revoked the privilege
PRIV_USED NUMBER Numerical code of privileges, if any, used in the action
SES_ACTIONS VARCHAR2(16)

Session summary for standard audit records. A string of 12 characters, one for each action type, in the following order: Alter, Audit, Comment, Delete, Grant, Index, Insert, Lock, Rename, Select, Update, Flashback.

Values: - = None, S=Success, F=Failure, B=Both
OS_PRIVILEGE VARCHAR2(7)

This column is populated only for administrative authentication audit records. It contains the administrative privilege used (for example, SYSDBA, SYSOPER, NONE).

For all other types of audit records, the value of this column is null.
ECONTEXT_ID VARCHAR2(64) Application execution context identifier
SQL_BIND VARCHAR2(4000) List of bind variables used in the statement
SQL_TEXT VARCHAR2(4000) The statement or command that triggered the audit event
OBJ_EDITION_NAME VARCHAR2(128) Name of the edition containing the audited object
DBID NUMBER Database identifier of the audited database
RLS_INFO VARCHAR2(4000)

Stores virtual private database (VPD) policy names and predicates separated by delimiter.

To format the output into individual rows, use the DBMS_AUDIT_UTIL.DECODE_RLS_INFO_ATRAIL_XML function.

CURRENT_USER VARCHAR2(128) Effective user for the statement execution
CON_ID NUMBER

The ID of the container to which the data pertains. Possible values include:

  • 0: This value is used for rows containing data that pertain to the entire CDB. This value is also used for rows in non-CDBs.

  • 1: This value is used for rows containing data that pertain to only the root

  • n: Where n is the applicable container ID for the rows containing data

Note: The SQL_BIND and SQL_TEXT columns are only populated if the AUDIT_TRAIL initialization parameter is set to xml, extended or if the AUDIT_SYS_OPERATIONS initialization parameter is set to TRUE.

See Also: