ORACLE Audit files *.aud

[Enrico Venturi]

Hello colleagues,
I've suddenly discovered that ORACLE producses a lot od audit files in the area /opt/oracle/rdbms/audit ...
ORACLE release is the 8.1.7.
I'd like to know:
what do they need for?
How can I disable them to avoid to fill the disk with unuseful informations?

thanks
Enrico

[T G Manikandan · Accepted solution]

These .aud files are the audit files for auditing administrative connections

These files gets created even when you disable auditing.

You can remove these files

[T G Manikandan]

check the desciption from Metalink.Attached

[Yogeeraj_1]

hi Enrico,

Verify your database initialisation parameters:

SQL> show parameter audit

NAME TYPE VALUE
------------------------------------ ------- ------------------------------
audit_file_dest string ?/rdbms/audit
audit_trail string NONE
transaction_auditing boolean TRUE
SQL>

If not the same, you can edit the init.ora file for the parameter, AUDIT_TRAIL to none and restart the database.


But there are certain database-related actions that Oracle will always audit and write into the operating system audit trail.
These events include the following:
- Instance startup
- Instance shutdown
- Connections to the database with administrator privileges

These events are audited regardless of whether database auditing is enabled so you cannot disable it.

Please see the Oracle8i Administrator's manual, Chapter 24, Auditing Database Use for details.

hope this helps!

regards
Yogeeraj

[Fabio Ettore]

Ciao Enrico,

I have searched out ITRC knolwedge base and I have found the following info:

You can verify mondbfile.sh by typing this line:


_________________________________________
/opt/OV/bin/OpC/utils/opcdcode /var/opt/OV/conf/OpC/monitor | more

Look for mondbfile section.

Audit files are generated even though auditing is turned off by three
events: start, stop, and connect. These events have to be audited
regardless of the setting of

audit_trail=NONE

This function is described in the auditing section of the Oracle server
manual. As long as mondbfile.sh is doing 'connect', it will be always
audited.
_________________________________________


Anyway you can remove these file. Doc suggests to remove them by a cron job.

I hope this helps you.

Best regards,
Ettore

[Yogeeraj_1]

hi again,

You should note the following Optimal Flexible Architecture (OFA) provided by Oracle.

where Subdirectories for Database Administration Files are mentioned to be as follows:
===========================================================
Subdirectory _________ Description
===========================================================
adhoc ________________ ad hoc SQL scripts for a given database
arch _________________ archived redo log files
adump ________________ audit files(Set AUDIT_FILE_DEST in configdb_name.ora to point here.
______________________ Remove unused files from this subdirectory periodically).
bdump_________________ background process trace files
cdump_________________ core dump files
create _______________ programs used to create the database
exp __________________ database export files
logbook_______________ files recording the status and history of the database
pfile_________________ instance parameter files
udump_________________ user SQL trace files
===========================================================

regards
Yogeeraj

[T G Manikandan]

Even you set AUDIT_TRIAL=false and to disable auditing it will stop auditing for the normal sessions/users.
It will not stop the .aud files getting generated.
These .aud files will get created as to audit the administrative logins on the oracle instance.

Just open those files.THey are ascii files and will provide the detail info of their need.