Analyze Audit Events on the Activity Auditing Dashboard

You can view and analyze auditing activity from the Activity Auditing dashboard. By default, the dashboard shows you audit events for the past one week.

View and Filter the Activity Auditing Dashboard

You can filter data displayed on the Activity Auditing dashboard by compartment, time period, and/or target database.

1. Under Security Center, click Activity Auditing.
   The Activity Auditing dashboard is displayed.
2. From the Compartment drop-down list, select the compartment that contains the target databases for which you want to view audit events. Optionally, you can select Include child compartments.
3. From the Time Period drop-down list, select the time period for the audit events.
   You can select Last 24 Hours, Last 1 Week, Last 1 Month, Last 3 Months, Last 6 Months, or Date Range.
   If you select Date Range, specify the beginning (Time From Month) and end (Time To Month) months.
4. From the Target Databases drop-down list, select a specific target database or All.
   Only target databases that are contained in the compartment (and child compartments if you selected the option) are listed.
   If you select All, then data for all target databases in the selected compartment is included in the dashboard.
   As you enter the name of a target database, the list of target database names is filtered.
5. View the Failed Login Activity, Admin Activity, and All Activity charts.
6. View the Events Summary and Targets Summary tabs.

Analyze Audit Event Data

1. Under Security Center, click Activity Auditing.
   The Activity Auditing dashboard is displayed.
2. Filter the dashboard as needed.
3. To view more detail for an audit event, on the Events Summary tab, click an event category.
   The Event Category page is displayed showing you a report for the audit event.
4. To view more detail for a target database, on the Targets Summary tab, click a target database.
5. At the top of the page, view the filters that are currently applied to the data.
   These filters are the same as those that were applied to the dashboard.
   You can modify, remove, and add filters as needed.
6. View the summary totals.
7. To view the target database names, click Targets.
   A Targets dialog box is displayed listing the target database names. Click Close to close the dialog box.
8. To filter the data in the table below the summary totals, click on any of the other summary totals and set a filter.
9. In the table at the bottom of the page, view the list of audit events.
10. To add and remove columns from the audit events list, from the Actions menu, select Manage Columns. The Manage Columns screen is displayed. Select/deselect columns, and then click Save Changes.

    The following columns are available:

    • Target
    • Target Type
    • Target Class
    • Location
    • DB User
    • Unified Audit Policies
    • OS User
    • Client Host
    • Client IP
    • Client Program
    • Client ID
    • Terminal
    • Event
    • Operation
    • Object
    • Object Type
    • Object Owner
    • Operation Status
    • Error Code
    • Error message
    • Operation Time
    • Event Fetch Time
    • SQL Text
    • SQL Param
    • Additional SQL
    • Audit Type