Welcome back all!
I have a 11.2.0.4.0 database with the parameter AUDIT_TRAIL=db,extended. I also have some AUDITED statements, like system privileges use and logon/logoff in all users.
Everything was fine until I enable a deeper auditing with an user like this:
AUDIT select table BY username;
After this, the table AUD$ started to grow very fast, we do not have the storage prepared for this type of AUDIT, so, we had to undo the AUDIT statement with:
NOAUDIT select table BY username;
The return was NOAUDIT CORRECT, but, the audit is still being generated for that user, It generates rows with the ACTION_NAME:
SELECT
SESSION REC
I started to run all NOAUDIT options, they are:
NOAUDIT all;
NOAUDIT all ON default;
NOAUDIT role;
NOAUDIT all statements;
NOAUDIT all privileges;
NOAUDIT select table BY username;
NOAUDIT select any table;
I also run the NOAUDIT statement for each TABLE of username like this (with a granted user and the username):
NOAUDIT SELECT ON username.table1;
NOAUDIT SELECT ON username.table2;
...
NOAUDIT SELECT ON username.tableN;
Without success, now, I don't have another audit except SELECT and SESSION REC for username user. Another trail is the only table that returns something is DBA_AUDIT_OBJECT, this other three do not returns any row:
dba_audit_exists
dba_audit_session
dba_audit_statement
By the way, the table DBA_OBJ_AUDIT_OPTS is also with zero rows.
I did not want to restart the database in order to change the AUDIT_TRAIL parameter, there must be something to disable that specific AUDIT.
Thanks in advance!