How to stop or minimise generating .aud files into audit directory.

[Former Member]

HI All,

I am using oralce 11g where all the .aud files are generating under /saptrace/audit folder. Apprpximately in five mintes 50 files are getting generated.

Whether i have scheduled the DB13 job which runs once in a week but in 6 days the system generates milloins of files.

Below is the log which every file shows.

cat piq_ora_1953_1.aud
Audit file /oracle/PIQ/saptrace/audit/piq_ora_1953_1.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
ORACLE_HOME = /oracle/PIQ/112_64
System name:    Linux
Node name:      HSCDEV5
Release:        2.6.18-194.3.1.el5
Version:        #1 SMP Sun May 2 04:17:42 EDT 2010
Machine:        x86_64
VM name:        VMWare Version: 6
Instance name: PIQ
Redo thread mounted by this instance: 1
Oracle process number: 66
Unix process pid: 1953, image: oracle@HSCDEV5 (TNS V1-V3)

Mon Jul 23 19:03:36 2012 +01:00
LENGTH : '155'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'orapiq'
CLIENT TERMINAL:[0] ''
STATUS:[1] '0'
DBID:[10] '1602363456'\

Below find the summary of my parameter.

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /oracle/PIQ/saptrace/audit

audit_sys_operations                 boolean     FALSE

audit_syslog_level                   string

audit_trail                          string      NONE

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /oracle/PIQ/saptrace/audit

audit_sys_operations                 boolean     FALSE

audit_syslog_level                   string

audit_trail                          string      NONE

Kindly suggest me a way out.

With Regards

Rishav

[Former Member · Accepted solution]

Hi Orkun,

I have executed the command "NOAUDIT ALL;" for
stopping logs. But still they are generating in bulk.

Does it require any restart?

Hi Eduardo.

I have already applied this done executing the clean job in db13.
But question is why it is generating in bulk.

Estimated it is generating over 30000 thousand logs in a day of
one system.

With Regards

Rishav Sharma

[Former Member · Accepted solution]

HI All,

Took the restart too. But still on the same page.

With Regards

Rishav Sharma

[Former Member · Accepted solution]

Hi Stephan,

Yes, you are absolutely right. But can you hint what all thing could be the root cause and meanwhile

let me check few stuff which may be the culprit.

By the way thanks for your help.

With Regards

Rishav SHarma

[stefan_koehler · Accepted solution]

Hi Rishav,

well depending on the provided information (content of one audit file) it must be a script or program like BR*Tools that connects permanently by using OS authentication (!!).

As we don't know your environment and running procedures you have to check this on your own. Just take a look at any procedures that connect locally by using OS authentication (as SYSDBA).

Best Regards

Stefan

[Former Member]

HI All,

Sorry i am bit late in reply but thanks to you all who helped me out understanding the issue as i can

see in my systems that few RMAN process keeps on connecting with the Database with the sysdba user

that was the cause of my issue

With Regards

Rishav Sharma

[stefan_koehler]

Hi Rishav,

please ignore all the previous replies. Your current behavior has nothing to do with your auditing configuration, so all your previous actions were useless.

The files, that are currently created are caused by a feature called "mandatory auditing". You can not disable it. All activities that are covered by this feature are described here:

http://docs.oracle.com/cd/E11882_01/network.112/e16543/auditing.htm#DBSEG0622

The interesting question is: Why do you connect with SYSDBA privileges so often? It seems like there is something wrong in your environment.

Best Regards

Stefan

[Former Member]

Hi Orkun,

I have executed the command "NOAUDIT ALL;" for
stopping logs. But still they are generating in bulk.

Does it require any restart?

Hi Eduardo.

I have already applied this done executing the clean job in db13.
But question is why it is generating in bulk.

Estimated it is generating over 30000 thousand logs in a day of
one system.

With Regards

Rishav Sharma

[Former Member]

Hi Rishav,

In addition to Eduardo, you can disable the auditing by the command, below;

SQL>NOAUDIT;

Check the document, http://docs.oracle.com/cd/B28359_01/server.111/b28286/statements_9017.htm

Best regards,

Orkun Gedik

[former_member184473]

Hello Rishav,

Check the following note:

1551504 Cleaning up Oracle audit files

Regards,

Eduardo Rezende