Oracle DB Audit ALL

Question

I have a 5TB large database.

I want to audit everything , really everything.

First of all, I tried with AUDIT ALL , but according to Oracle's document AUDIT ALL does NOT audit everything ...

I know that this statement must be executed in order to start auditing db:

 alter system set audit_trail=db,extended scope=spfile;

But what else should I do to start auditing all the SQL statements that users execute?

Answer 1

You need not to use the AUDIT feature if you only want a view on user queries ( SELECT , UPDATE , INSERT ) on your database. $AUD contains rather DDL statements , whereas V$SQL contains only DML statements .

A very simple solution is to use another view: V$SQL . You can extract duration and lot of useful info from it.

Useful example:

  SELECT * FROM v$sql vv
   WHERE lower(vv.SQL_TEXT) like '%delete%'
     AND vv.PARSING_SCHEMA_NAME like 'A_SCHEMA%'
ORDER BY  vv.LAST_ACTIVE_TIME desc;

V$SQL lists statistics on shared SQL area without the GROUP BY clause and contains one row for each child of the original SQL text entered. Statistics displayed in V$SQL are normally updated at the end of query execution.

Long running queries are updated every 5 seconds. This shows the impact of long running SQLs while they are still working.