1. 初始化参数AUDIT_TRAIL用于控制数据库审计，取值说明:

none 禁用数据库审计
os 启用数据库审计，并将数据库审计记录定向到操作系统审计记录
db 启用数据库审计，并将数据库所有审计记录定向到数据库的SYS.AUD$表
db,extended 启用数据库审计，并将数据库所有审计记录定向到数据库的SYS.AUD$表。另外，填充SYS.AUD$表的SQLBIND 列和SQLTEXT CLOB 列。
xml 启用数据库审计，并将所有记录写到XML格式的操作系统文件中。
xml,extended 启用数据库审计，输出审计记录的所有列，包括SqlText和SqlBind的值。

Oracle公司还推荐使用基于OS文件的审计日志记录方式(OS audit trail files)。

2. 不同设置下audit trail的位置如下：

在日常的数据库维护中，经常出现因为数据库登录审计的功能启动,导致system表空间被用满.从而出现异常,一般建议把aud$相关对象迁移到其他表空间,从而避免system被用完的风险.

10g及以前迁移方法

alter table AUDIT$ move tablespace users;

alter table AUDIT_ACTIONS move tablespace users;

alter table AUD$ move tablespace users;

alter table AUD$ move lob(SQLBIND) store as SYS_IL0000000384C00041$$ (tablespace users);

alter table AUD$ move lob(SQLTEXT) store as SYS_IL0000000384C00041$$ (tablespace users);

alter index I_AUDIT rebuild online tablespace users;

alter index I_AUDIT_ACTIONS rebuild online tablespace users;

11g以后

可以使用DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION进行迁移

conn / as sysdba

BEGIN

DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION(audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_DB_STD,

audit_trail_location_value => 'USERS');

END;

/

10g及以前通过手工清理的方式或自定义作业来定期清理

DELETE FROM SYS.AUD$;

DELETE FROM SYS.AUD$

WHERE obj$name='EMP';

OS和XML选项下进行手动删除审计文件

11g 新特性

通过DBMS_AUDIT_MGMT包下的子过程进行手动或定期清理,功能如下

Subprogram	Description
CLEAN_AUDIT_TRAIL Procedure	Deletes audit trail records/files that have been archived
CLEAR_LAST_ARCHIVE_TIMESTAMP Procedure	Clears the timestamp set by the SET_LAST_ARCHIVE_TIMESTAMP Procedure
CREATE_PURGE_JOB Procedure	Creates a purge job for periodically deleting the audit trail records/files
DEINIT_CLEANUP Procedure	Undoes the setup and initialization performed by the INIT_CLEANUP Procedure
DROP_PURGE_JOB Procedure	Drops the purge job created using the CREATE_PURGE_JOB Procedure
INIT_CLEANUP Procedure	Sets up the audit management infrastructure and sets a default cleanup interval for audit trail records/files
IS_CLEANUP_INITIALIZED Function	Checks to see if the INIT_CLEANUP Procedure has been run for an audit trail type
SET_LAST_ARCHIVE_TIMESTAMP Procedure	Sets a timestamp indicating when the audit records/files were last archived
SET_PURGE_JOB_INTERVAL Procedure	Sets the interval at which the CLEAN_AUDIT_TRAIL Procedure is called for the purge job that you specify
SET_PURGE_JOB_STATUS Procedure	Enables or disables the purge job that you specify