Skip to Main Content
  • Questions

  • Unified audit doesn't write to trail

Breadcrumb

Question and Answer

Connor McDonald

Thanks for the question, Mikael.

Asked: April 04, 2017 - 1:59 pm UTC

Last updated: January 31, 2023 - 6:48 am UTC

Version: Oracle 12c

Viewed 1000+ times

You Asked

Hi Tom!

I am trying to set up some unified audit policies but whatever I set up I don't get the actions written to audit trail.

The only audits that is written is the ones that is per default installed and enabled so I can see that all my commands for creating and enabling my policy gets written to the audit trail but nothing for the created audit.

I have used the guide (lesson) from http://www.oracle.com/webfolder/technetwork/tutorials/obe/db/12c/r1/security/sec_uni_audit/sec_uni_audit.html as a template for my attempts.

This is the setup and what I have done:

-- verify that unified auditing is enabled
select * from v$option where PARAMETER = 'Unified Auditing';

PARAMETER VALUE CON_ID
----------------------------------------------------------------
Unified Auditing TRUE 0

1 row selected.


-- start example
-- create test table (data_owner)
create table data_owner.mili_audit_test (col1 varchar2(10));


-- create policy (sys)
CREATE AUDIT POLICY POL_MILI_TEST
ACTIONS ALL ON DATA_OWNER.MILI_AUDIT_TEST;


-- start policy (sys)
AUDIT POLICY POL_MILI_TEST EXCEPT DATA_OWNER;


-- check that policy is created (sys)
select POLICY_NAME, AUDIT_OPTION, OBJECT_NAME
from AUDIT_UNIFIED_POLICIES
where POLICY_NAME ='POL_MILI_TEST';

POLICY_NAME AUDIT_OPTION OBJECT_NAME
----------------------------------------
POL_MILI_TEST ALL MILI_AUDIT_TEST


-- check that policy is enabled
select POLICY_NAME, ENABLED_OPT, USER_NAME, SUCCESS, FAILURE
from AUDIT_UNIFIED_ENABLED_POLICIES
where POLICY_NAME ='POL_MILI_TEST'ยด;

POLICY_NAME ENABLED_OPT USER_NAME SUCCESS FAILURE
---------------------------------------------------------------
POL_MILI_TEST EXCEPT DATA_OWNER YES YES


-- Run insterts and selects from 3 different schemas (sys, data_owner and one more)
insert into DATA_OWNER.MILI_AUDIT_TEST values ('Test');

select *
from DATA_OWNER.MILI_AUDIT_TEST;

--> schema 1
------------
1 row created.

COL1
----------
Test1
1 row selected.

--> schema 2
------------
1 row created.

COL1
----------
Test2
Test1

2 rows selected.


--> schema 3
------------
1 row created.

COL1
----------
Test2
Test1
Test3

3 rows selected.


------------------------------
select *
from UNIFIED_AUDIT_TRAIL
where object_name = 'POL_MILI_TEST'
order by event_timestamp desc;

With this select (and full select) I don't find any records except the ones for
create/enable policy (CREATE AUDIT POLICY and AUDIT). No SELECT and no INSERT, why?

I'm sure it is something very basic I am missing here (as always) but what?

Regards,
Mikael

and Connor said...

Couple of important things you need to have:

- unified audit option is enabled (I think you've done this)
- audit_trail = none
- flush the audit trail to make sure you're seeing everything

Once that was done I repeated your script and got the records expected

SQL> create table mcdonac.mili_audit_test (col1 varchar2(10));

Table created.

SQL> grant all on mili_audit_test to public;

Grant succeeded.

SQL>
SQL> create audit policy pol_mili_test
  2  actions all on mcdonac.mili_audit_test;

Audit policy created.

SQL>
SQL> audit policy pol_mili_test except mcdonac;

Audit succeeded.

SQL>
SQL> select policy_name, audit_option, object_name
  2  from audit_unified_policies
  3  where policy_name ='POL_MILI_TEST';

POLICY_NAME
--------------------------------------------------------------------------------------------------------------------------------
AUDIT_OPTION
--------------------------------------------------------------------------------------------------------------------------------
OBJECT_NAME
----------------------------------------
POL_MILI_TEST
ALL
MILI_AUDIT_TEST


1 row selected.

SQL> select policy_name, enabled_opt, user_name, success, failure
  2  from audit_unified_enabled_policies
  3  where policy_name ='POL_MILI_TEST';

POLICY_NAME
--------------------------------------------------------------------------------------------------------------------------------
ENABLED
-------
USER_NAME
--------------------------------------------------------------------------------------------------------------------------------
SUC FAI
--- ---
POL_MILI_TEST
EXCEPT
MCDONAC
YES YES


1 row selected.

SQL> conn scott/tiger
Connected.

SQL> insert into mcdonac.mili_audit_test values ('Test');

1 row created.

SQL> commit;

Commit complete.

SQL> select *
  2  from mcdonac.mili_audit_test;

COL1
----------
Test

1 row selected.

SQL> conn mcdonac/******
Connected.

SQL> exec dbms_audit_mgmt.flush_unified_audit_trail;

PL/SQL procedure successfully completed.

SQL> select *
  2  from UNIFIED_AUDIT_TRAIL
  3  where 1=1 --object_name = 'POL_MILI_TEST'
  4  order by event_timestamp desc
  5  @pr
==============================
AUDIT_TYPE                    : Standard
SESSIONID                     : 2146929243
PROXY_SESSIONID               : 0
OS_USERNAME                   : XPS13\hamcdc
USERHOST                      : WORKGROUP\XPS13
TERMINAL                      : XPS13
INSTANCE_ID                   : 1
DBID                          : 872342268
AUTHENTICATION_TYPE           : (TYPE=(DATABASE));
DBUSERNAME                    : MCDONAC
DBPROXY_USERNAME              :
EXTERNAL_USERID               :
GLOBAL_USERID                 :
CLIENT_PROGRAM_NAME           : sqlplus.exe
DBLINK_INFO                   :
XS_USER_NAME                  :
XS_SESSIONID                  :
ENTRY_ID                      : 1
STATEMENT_ID                  : 12
EVENT_TIMESTAMP               : 16-APR-17 02.31.21.348000 PM
ACTION_NAME                   : EXECUTE
RETURN_CODE                   : 0
OS_PROCESS                    : 11740:11176
TRANSACTION_ID                :
SCN                           : 14815791230250
EXECUTION_ID                  :
OBJECT_SCHEMA                 : SYS
OBJECT_NAME                   : DBMS_AUDIT_MGMT
SQL_TEXT                      : BEGIN dbms_audit_mgmt.flush_unified_audit_trail; END;

SQL_BINDS                     :
APPLICATION_CONTEXTS          :
CLIENT_IDENTIFIER             :
NEW_SCHEMA                    :
NEW_NAME                      :
OBJECT_EDITION                :
SYSTEM_PRIVILEGE_USED         :
SYSTEM_PRIVILEGE              :
AUDIT_OPTION                  :
OBJECT_PRIVILEGES             :
ROLE                          :
TARGET_USER                   :
EXCLUDED_USER                 :
EXCLUDED_SCHEMA               :
EXCLUDED_OBJECT               :
CURRENT_USER                  : MCDONAC
ADDITIONAL_INFO               :
UNIFIED_AUDIT_POLICIES        :
FGA_POLICY_NAME               :
XS_INACTIVITY_TIMEOUT         :
XS_ENTITY_TYPE                :
XS_TARGET_PRINCIPAL_NAME      :
XS_PROXY_USER_NAME            :
XS_DATASEC_POLICY_NAME        :
XS_SCHEMA_NAME                :
XS_CALLBACK_EVENT_TYPE        :
XS_PACKAGE_NAME               :
XS_PROCEDURE_NAME             :
XS_ENABLED_ROLE               :
XS_COOKIE                     :
XS_NS_NAME                    :
XS_NS_ATTRIBUTE               :
XS_NS_ATTRIBUTE_OLD_VAL       :
XS_NS_ATTRIBUTE_NEW_VAL       :
DV_ACTION_CODE                :
DV_ACTION_NAME                :
DV_EXTENDED_ACTION_CODE       :
DV_GRANTEE                    :
DV_RETURN_CODE                :
DV_ACTION_OBJECT_NAME         :
DV_RULE_SET_NAME              :
DV_COMMENT                    :
DV_FACTOR_CONTEXT             :
DV_OBJECT_STATUS              :
OLS_POLICY_NAME               :
OLS_GRANTEE                   :
OLS_MAX_READ_LABEL            :
OLS_MAX_WRITE_LABEL           :
OLS_MIN_WRITE_LABEL           :
OLS_PRIVILEGES_GRANTED        :
OLS_PROGRAM_UNIT_NAME         :
OLS_PRIVILEGES_USED           :
OLS_STRING_LABEL              :
OLS_LABEL_COMPONENT_TYPE      :
OLS_LABEL_COMPONENT_NAME      :
OLS_PARENT_GROUP_NAME         :
OLS_OLD_VALUE                 :
OLS_NEW_VALUE                 :
RMAN_SESSION_RECID            :
RMAN_SESSION_STAMP            :
RMAN_OPERATION                :
RMAN_OBJECT_TYPE              :
RMAN_DEVICE_TYPE              :
DP_TEXT_PARAMETERS1           :
DP_BOOLEAN_PARAMETERS1        :
DIRECT_PATH_NUM_COLUMNS_LOADED:
RLS_INFO                      :
KSACL_USER_NAME               :
KSACL_SERVICE_NAME            :
KSACL_SOURCE_LOCATION         :
==============================
AUDIT_TYPE                    : Standard
SESSIONID                     : 653736211
PROXY_SESSIONID               : 0
OS_USERNAME                   : XPS13\hamcdc
USERHOST                      : WORKGROUP\XPS13
TERMINAL                      : XPS13
INSTANCE_ID                   : 1
DBID                          : 872342268
AUTHENTICATION_TYPE           : (TYPE=(DATABASE));
DBUSERNAME                    : SCOTT
DBPROXY_USERNAME              :
EXTERNAL_USERID               :
GLOBAL_USERID                 :
CLIENT_PROGRAM_NAME           : sqlplus.exe
DBLINK_INFO                   :
XS_USER_NAME                  :
XS_SESSIONID                  :
ENTRY_ID                      : 2
STATEMENT_ID                  : 14
EVENT_TIMESTAMP               : 16-APR-17 02.31.21.270000 PM
ACTION_NAME                   : SELECT
RETURN_CODE                   : 0
OS_PROCESS                    : 11740:1180
TRANSACTION_ID                :
SCN                           : 14815791230246
EXECUTION_ID                  :
OBJECT_SCHEMA                 : MCDONAC
OBJECT_NAME                   : MILI_AUDIT_TEST
SQL_TEXT                      : select *
from mcdonac.mili_audit_test
SQL_BINDS                     :
APPLICATION_CONTEXTS          :
CLIENT_IDENTIFIER             :
NEW_SCHEMA                    :
NEW_NAME                      :
OBJECT_EDITION                :
SYSTEM_PRIVILEGE_USED         :
SYSTEM_PRIVILEGE              :
AUDIT_OPTION                  :
OBJECT_PRIVILEGES             :
ROLE                          :
TARGET_USER                   :
EXCLUDED_USER                 :
EXCLUDED_SCHEMA               :
EXCLUDED_OBJECT               :
CURRENT_USER                  : SCOTT
ADDITIONAL_INFO               :
UNIFIED_AUDIT_POLICIES        : POL_MILI_TEST
FGA_POLICY_NAME               :
XS_INACTIVITY_TIMEOUT         :
XS_ENTITY_TYPE                :
XS_TARGET_PRINCIPAL_NAME      :
XS_PROXY_USER_NAME            :
XS_DATASEC_POLICY_NAME        :
XS_SCHEMA_NAME                :
XS_CALLBACK_EVENT_TYPE        :
XS_PACKAGE_NAME               :
XS_PROCEDURE_NAME             :
XS_ENABLED_ROLE               :
XS_COOKIE                     :
XS_NS_NAME                    :
XS_NS_ATTRIBUTE               :
XS_NS_ATTRIBUTE_OLD_VAL       :
XS_NS_ATTRIBUTE_NEW_VAL       :
DV_ACTION_CODE                :
DV_ACTION_NAME                :
DV_EXTENDED_ACTION_CODE       :
DV_GRANTEE                    :
DV_RETURN_CODE                :
DV_ACTION_OBJECT_NAME         :
DV_RULE_SET_NAME              :
DV_COMMENT                    :
DV_FACTOR_CONTEXT             :
DV_OBJECT_STATUS              :
OLS_POLICY_NAME               :
OLS_GRANTEE                   :
OLS_MAX_READ_LABEL            :
OLS_MAX_WRITE_LABEL           :
OLS_MIN_WRITE_LABEL           :
OLS_PRIVILEGES_GRANTED        :
OLS_PROGRAM_UNIT_NAME         :
OLS_PRIVILEGES_USED           :
OLS_STRING_LABEL              :
OLS_LABEL_COMPONENT_TYPE      :
OLS_LABEL_COMPONENT_NAME      :
OLS_PARENT_GROUP_NAME         :
OLS_OLD_VALUE                 :
OLS_NEW_VALUE                 :
RMAN_SESSION_RECID            :
RMAN_SESSION_STAMP            :
RMAN_OPERATION                :
RMAN_OBJECT_TYPE              :
RMAN_DEVICE_TYPE              :
DP_TEXT_PARAMETERS1           :
DP_BOOLEAN_PARAMETERS1        :
DIRECT_PATH_NUM_COLUMNS_LOADED:
RLS_INFO                      :
KSACL_USER_NAME               :
KSACL_SERVICE_NAME            :
KSACL_SOURCE_LOCATION         :
==============================
AUDIT_TYPE                    : Standard
SESSIONID                     : 653736211
PROXY_SESSIONID               : 0
OS_USERNAME                   : XPS13\hamcdc
USERHOST                      : WORKGROUP\XPS13
TERMINAL                      : XPS13
INSTANCE_ID                   : 1
DBID                          : 872342268
AUTHENTICATION_TYPE           : (TYPE=(DATABASE));
DBUSERNAME                    : SCOTT
DBPROXY_USERNAME              :
EXTERNAL_USERID               :
GLOBAL_USERID                 :
CLIENT_PROGRAM_NAME           : sqlplus.exe
DBLINK_INFO                   :
XS_USER_NAME                  :
XS_SESSIONID                  :
ENTRY_ID                      : 1
STATEMENT_ID                  : 12
EVENT_TIMESTAMP               : 16-APR-17 02.31.21.254000 PM
ACTION_NAME                   : INSERT
RETURN_CODE                   : 0
OS_PROCESS                    : 11740:1180
TRANSACTION_ID                : 07000100BD130000
SCN                           : 14815791230240
EXECUTION_ID                  :
OBJECT_SCHEMA                 : MCDONAC
OBJECT_NAME                   : MILI_AUDIT_TEST
SQL_TEXT                      : insert into mcdonac.mili_audit_test values ('Test')
SQL_BINDS                     :
APPLICATION_CONTEXTS          :
CLIENT_IDENTIFIER             :
NEW_SCHEMA                    :
NEW_NAME                      :
OBJECT_EDITION                :
SYSTEM_PRIVILEGE_USED         :
SYSTEM_PRIVILEGE              :
AUDIT_OPTION                  :
OBJECT_PRIVILEGES             :
ROLE                          :
TARGET_USER                   :
EXCLUDED_USER                 :
EXCLUDED_SCHEMA               :
EXCLUDED_OBJECT               :
CURRENT_USER                  : SCOTT
ADDITIONAL_INFO               :
UNIFIED_AUDIT_POLICIES        : POL_MILI_TEST
FGA_POLICY_NAME               :
XS_INACTIVITY_TIMEOUT         :
XS_ENTITY_TYPE                :
XS_TARGET_PRINCIPAL_NAME      :
XS_PROXY_USER_NAME            :
XS_DATASEC_POLICY_NAME        :
XS_SCHEMA_NAME                :
XS_CALLBACK_EVENT_TYPE        :
XS_PACKAGE_NAME               :
XS_PROCEDURE_NAME             :
XS_ENABLED_ROLE               :
XS_COOKIE                     :
XS_NS_NAME                    :
XS_NS_ATTRIBUTE               :
XS_NS_ATTRIBUTE_OLD_VAL       :
XS_NS_ATTRIBUTE_NEW_VAL       :
DV_ACTION_CODE                :
DV_ACTION_NAME                :
DV_EXTENDED_ACTION_CODE       :
DV_GRANTEE                    :
DV_RETURN_CODE                :
DV_ACTION_OBJECT_NAME         :
DV_RULE_SET_NAME              :
DV_COMMENT                    :
DV_FACTOR_CONTEXT             :
DV_OBJECT_STATUS              :
OLS_POLICY_NAME               :
OLS_GRANTEE                   :
OLS_MAX_READ_LABEL            :
OLS_MAX_WRITE_LABEL           :
OLS_MIN_WRITE_LABEL           :
OLS_PRIVILEGES_GRANTED        :
OLS_PROGRAM_UNIT_NAME         :
OLS_PRIVILEGES_USED           :
OLS_STRING_LABEL              :
OLS_LABEL_COMPONENT_TYPE      :
OLS_LABEL_COMPONENT_NAME      :
OLS_PARENT_GROUP_NAME         :
OLS_OLD_VALUE                 :
OLS_NEW_VALUE                 :
RMAN_SESSION_RECID            :
RMAN_SESSION_STAMP            :
RMAN_OPERATION                :
RMAN_OBJECT_TYPE              :
RMAN_DEVICE_TYPE              :
DP_TEXT_PARAMETERS1           :
DP_BOOLEAN_PARAMETERS1        :
DIRECT_PATH_NUM_COLUMNS_LOADED:
RLS_INFO                      :
KSACL_USER_NAME               :
KSACL_SERVICE_NAME            :
KSACL_SOURCE_LOCATION         :
==============================
AUDIT_TYPE                    : Standard
SESSIONID                     : 920231926
PROXY_SESSIONID               : 0
OS_USERNAME                   : XPS13\hamcdc
USERHOST                      : WORKGROUP\XPS13
TERMINAL                      : XPS13
INSTANCE_ID                   : 1
DBID                          : 872342268
AUTHENTICATION_TYPE           : (TYPE=(DATABASE));
DBUSERNAME                    : MCDONAC
DBPROXY_USERNAME              :
EXTERNAL_USERID               :
GLOBAL_USERID                 :
CLIENT_PROGRAM_NAME           : sqlplus.exe
DBLINK_INFO                   :
XS_USER_NAME                  :
XS_SESSIONID                  :
ENTRY_ID                      : 3
STATEMENT_ID                  : 62
EVENT_TIMESTAMP               : 16-APR-17 02.31.21.014000 PM
ACTION_NAME                   : CREATE AUDIT POLICY
RETURN_CODE                   : 0
OS_PROCESS                    : 11740:6136
TRANSACTION_ID                : 0000000000000000
SCN                           : 14815791230223
EXECUTION_ID                  :
OBJECT_SCHEMA                 : SYS
OBJECT_NAME                   : POL_MILI_TEST
SQL_TEXT                      : create audit policy pol_mili_test
actions all on mcdonac.mili_audit_test
SQL_BINDS                     :
APPLICATION_CONTEXTS          :
CLIENT_IDENTIFIER             :
NEW_SCHEMA                    :
NEW_NAME                      :
OBJECT_EDITION                :
SYSTEM_PRIVILEGE_USED         : AUDIT SYSTEM
SYSTEM_PRIVILEGE              :
AUDIT_OPTION                  :
OBJECT_PRIVILEGES             :
ROLE                          :
TARGET_USER                   :
EXCLUDED_USER                 :
EXCLUDED_SCHEMA               :
EXCLUDED_OBJECT               :
CURRENT_USER                  : MCDONAC
ADDITIONAL_INFO               :
UNIFIED_AUDIT_POLICIES        :
FGA_POLICY_NAME               :
XS_INACTIVITY_TIMEOUT         :
XS_ENTITY_TYPE                :
XS_TARGET_PRINCIPAL_NAME      :
XS_PROXY_USER_NAME            :
XS_DATASEC_POLICY_NAME        :
XS_SCHEMA_NAME                :
XS_CALLBACK_EVENT_TYPE        :
XS_PACKAGE_NAME               :
XS_PROCEDURE_NAME             :
XS_ENABLED_ROLE               :
XS_COOKIE                     :
XS_NS_NAME                    :
XS_NS_ATTRIBUTE               :
XS_NS_ATTRIBUTE_OLD_VAL       :
XS_NS_ATTRIBUTE_NEW_VAL       :
DV_ACTION_CODE                :
DV_ACTION_NAME                :
DV_EXTENDED_ACTION_CODE       :
DV_GRANTEE                    :
DV_RETURN_CODE                :
DV_ACTION_OBJECT_NAME         :
DV_RULE_SET_NAME              :
DV_COMMENT                    :
DV_FACTOR_CONTEXT             :
DV_OBJECT_STATUS              :
OLS_POLICY_NAME               :
OLS_GRANTEE                   :
OLS_MAX_READ_LABEL            :
OLS_MAX_WRITE_LABEL           :
OLS_MIN_WRITE_LABEL           :
OLS_PRIVILEGES_GRANTED        :
OLS_PROGRAM_UNIT_NAME         :
OLS_PRIVILEGES_USED           :
OLS_STRING_LABEL              :
OLS_LABEL_COMPONENT_TYPE      :
OLS_LABEL_COMPONENT_NAME      :
OLS_PARENT_GROUP_NAME         :
OLS_OLD_VALUE                 :
OLS_NEW_VALUE                 :
RMAN_SESSION_RECID            :
RMAN_SESSION_STAMP            :
RMAN_OPERATION                :
RMAN_OBJECT_TYPE              :
RMAN_DEVICE_TYPE              :
DP_TEXT_PARAMETERS1           :
DP_BOOLEAN_PARAMETERS1        :
DIRECT_PATH_NUM_COLUMNS_LOADED:
RLS_INFO                      :
KSACL_USER_NAME               :
KSACL_SERVICE_NAME            :
KSACL_SOURCE_LOCATION         :
==============================
AUDIT_TYPE                    : Standard
SESSIONID                     : 920231926
PROXY_SESSIONID               : 0
OS_USERNAME                   : XPS13\hamcdc
USERHOST                      : WORKGROUP\XPS13
TERMINAL                      : XPS13
INSTANCE_ID                   : 1
DBID                          : 872342268
AUTHENTICATION_TYPE           : (TYPE=(DATABASE));
DBUSERNAME                    : MCDONAC
DBPROXY_USERNAME              :
EXTERNAL_USERID               :
GLOBAL_USERID                 :
CLIENT_PROGRAM_NAME           : sqlplus.exe
DBLINK_INFO                   :
XS_USER_NAME                  :
XS_SESSIONID                  :
ENTRY_ID                      : 4
STATEMENT_ID                  : 88
EVENT_TIMESTAMP               : 16-APR-17 02.31.21.014000 PM
ACTION_NAME                   : AUDIT
RETURN_CODE                   : 0
OS_PROCESS                    : 11740:6136
TRANSACTION_ID                : 07000000B6130000
SCN                           : 14815791230231
EXECUTION_ID                  :
OBJECT_SCHEMA                 : SYS
OBJECT_NAME                   : POL_MILI_TEST
SQL_TEXT                      : audit policy pol_mili_test except mcdonac
SQL_BINDS                     :
APPLICATION_CONTEXTS          :
CLIENT_IDENTIFIER             :
NEW_SCHEMA                    :
NEW_NAME                      :
OBJECT_EDITION                :
SYSTEM_PRIVILEGE_USED         : AUDIT SYSTEM
SYSTEM_PRIVILEGE              :
AUDIT_OPTION                  :
OBJECT_PRIVILEGES             :
ROLE                          :
TARGET_USER                   :
EXCLUDED_USER                 : MCDONAC
EXCLUDED_SCHEMA               :
EXCLUDED_OBJECT               :
CURRENT_USER                  : MCDONAC
ADDITIONAL_INFO               :
UNIFIED_AUDIT_POLICIES        :
FGA_POLICY_NAME               :
XS_INACTIVITY_TIMEOUT         :
XS_ENTITY_TYPE                :
XS_TARGET_PRINCIPAL_NAME      :
XS_PROXY_USER_NAME            :
XS_DATASEC_POLICY_NAME        :
XS_SCHEMA_NAME                :
XS_CALLBACK_EVENT_TYPE        :
XS_PACKAGE_NAME               :
XS_PROCEDURE_NAME             :
XS_ENABLED_ROLE               :
XS_COOKIE                     :
XS_NS_NAME                    :
XS_NS_ATTRIBUTE               :
XS_NS_ATTRIBUTE_OLD_VAL       :
XS_NS_ATTRIBUTE_NEW_VAL       :
DV_ACTION_CODE                :
DV_ACTION_NAME                :
DV_EXTENDED_ACTION_CODE       :
DV_GRANTEE                    :
DV_RETURN_CODE                :
DV_ACTION_OBJECT_NAME         :
DV_RULE_SET_NAME              :
DV_COMMENT                    :
DV_FACTOR_CONTEXT             :
DV_OBJECT_STATUS              :
OLS_POLICY_NAME               :
OLS_GRANTEE                   :
OLS_MAX_READ_LABEL            :
OLS_MAX_WRITE_LABEL           :
OLS_MIN_WRITE_LABEL           :
OLS_PRIVILEGES_GRANTED        :
OLS_PROGRAM_UNIT_NAME         :
OLS_PRIVILEGES_USED           :
OLS_STRING_LABEL              :
OLS_LABEL_COMPONENT_TYPE      :
OLS_LABEL_COMPONENT_NAME      :
OLS_PARENT_GROUP_NAME         :
OLS_OLD_VALUE                 :
OLS_NEW_VALUE                 :
RMAN_SESSION_RECID            :
RMAN_SESSION_STAMP            :
RMAN_OPERATION                :
RMAN_OBJECT_TYPE              :
RMAN_DEVICE_TYPE              :
DP_TEXT_PARAMETERS1           :
DP_BOOLEAN_PARAMETERS1        :
DIRECT_PATH_NUM_COLUMNS_LOADED:
RLS_INFO                      :
KSACL_USER_NAME               :
KSACL_SERVICE_NAME            :
KSACL_SOURCE_LOCATION         :
==============================
AUDIT_TYPE                    : Standard
SESSIONID                     : 350031
PROXY_SESSIONID               : 0
OS_USERNAME                   :
USERHOST                      : WORKGROUP\XPS13
TERMINAL                      :
INSTANCE_ID                   : 0
DBID                          : 872342268
AUTHENTICATION_TYPE           :
DBUSERNAME                    : MCDONAC
DBPROXY_USERNAME              :
EXTERNAL_USERID               :
GLOBAL_USERID                 :
CLIENT_PROGRAM_NAME           : sqlplus.exe
DBLINK_INFO                   :
XS_USER_NAME                  :
XS_SESSIONID                  : 000000000000000000000000000000000000000000000000000000000000000000
ENTRY_ID                      : 0
STATEMENT_ID                  : 0
EVENT_TIMESTAMP               : 03-APR-17 12.18.53.274000 PM
ACTION_NAME                   : LOGOFF BY CLEANUP
RETURN_CODE                   : 0
OS_PROCESS                    : 7480:4824
TRANSACTION_ID                : 0000000000000000
SCN                           : 0
EXECUTION_ID                  :
OBJECT_SCHEMA                 :
OBJECT_NAME                   :
SQL_TEXT                      :
SQL_BINDS                     :
APPLICATION_CONTEXTS          :
CLIENT_IDENTIFIER             :
NEW_SCHEMA                    :
NEW_NAME                      :
OBJECT_EDITION                :
SYSTEM_PRIVILEGE_USED         :
SYSTEM_PRIVILEGE              :
AUDIT_OPTION                  :
OBJECT_PRIVILEGES             :
ROLE                          :
TARGET_USER                   :
EXCLUDED_USER                 :
EXCLUDED_SCHEMA               :
EXCLUDED_OBJECT               :
CURRENT_USER                  :
ADDITIONAL_INFO               :
UNIFIED_AUDIT_POLICIES        :
FGA_POLICY_NAME               :
XS_INACTIVITY_TIMEOUT         : 0
XS_ENTITY_TYPE                :
XS_TARGET_PRINCIPAL_NAME      :
XS_PROXY_USER_NAME            :
XS_DATASEC_POLICY_NAME        :
XS_SCHEMA_NAME                :
XS_CALLBACK_EVENT_TYPE        :
XS_PACKAGE_NAME               :
XS_PROCEDURE_NAME             :
XS_ENABLED_ROLE               :
XS_COOKIE                     :
XS_NS_NAME                    :
XS_NS_ATTRIBUTE               :
XS_NS_ATTRIBUTE_OLD_VAL       :
XS_NS_ATTRIBUTE_NEW_VAL       :
DV_ACTION_CODE                : 0
DV_ACTION_NAME                :
DV_EXTENDED_ACTION_CODE       : 0
DV_GRANTEE                    :
DV_RETURN_CODE                : 0
DV_ACTION_OBJECT_NAME         :
DV_RULE_SET_NAME              :
DV_COMMENT                    :
DV_FACTOR_CONTEXT             :
DV_OBJECT_STATUS              :
OLS_POLICY_NAME               :
OLS_GRANTEE                   :
OLS_MAX_READ_LABEL            :
OLS_MAX_WRITE_LABEL           :
OLS_MIN_WRITE_LABEL           :
OLS_PRIVILEGES_GRANTED        :
OLS_PROGRAM_UNIT_NAME         :
OLS_PRIVILEGES_USED           :
OLS_STRING_LABEL              :
OLS_LABEL_COMPONENT_TYPE      :
OLS_LABEL_COMPONENT_NAME      :
OLS_PARENT_GROUP_NAME         :
OLS_OLD_VALUE                 :
OLS_NEW_VALUE                 :
RMAN_SESSION_RECID            : 0
RMAN_SESSION_STAMP            : 0
RMAN_OPERATION                :
RMAN_OBJECT_TYPE              :
RMAN_DEVICE_TYPE              :
DP_TEXT_PARAMETERS1           :
DP_BOOLEAN_PARAMETERS1        :
DIRECT_PATH_NUM_COLUMNS_LOADED: 0
RLS_INFO                      :
KSACL_USER_NAME               :
KSACL_SERVICE_NAME            :
KSACL_SOURCE_LOCATION         :

PL/SQL procedure successfully completed.


SQL>


Rating

  (1 rating)

Is this answer out of date? If it is, please let us know via a Comment

Comments

@pr formatting magic??

Narendra, January 26, 2023 - 10:20 am UTC

Hello Connor,

How do you achieve below where you type the query at the prompt and then you call "pr" script which runs ot and produces the formatted output?

SQL> select *
  2  from UNIFIED_AUDIT_TRAIL
  3  where 1=1 --object_name = 'POL_MILI_TEST'
  4  order by event_timestamp desc
  5  @pr
==============================

Connor McDonald
January 31, 2023 - 6:48 am UTC

Head over to the my github repo

https://github.com/connormcd/misc-scripts

Credit: Tom Kyte / Tanel Poder
more

Connor and Chris don't just spend all day on AskTOM. You can also catch regular content via Connor's blog and Chris's blog. Or if video is more your thing, check out Connor's latest video and Chris's latest video from their Youtube channels. And of course, keep up to date with AskTOM via the official twitter account.

More to Explore

Security

All of the vital components for a secure database are covered in the Security guide.