Where should customers write their Oracle audit trail?
The Oracle database auditing facility supports flexible locations and formats to record the audit trail. You can write the audit trail to database tables, OS files in a flat file or XML format, and the syslog (UNIX). From a performance perspective, it requires less resource to write the audit trail to an OS file. The XML format provides the ability to include SQL text and bind variables as part of the audit trail. From a security perspective, the OS files can only be accessed by the Oracle database owner where syslog can only be written to by the root user and provides separation of duty from the DBA. To lock down the database audit tables, you can install Database Vault and put a protective realm around them. Oracle database parameters dictate where the audit trail record is written and the additional inclusion of SQL text/bind variables content. o audit_trail : defines where the audit trail is located. If the value appends ‘extended’, it will also include SQL text and bind variables.
