Database Software

select * from v$version;
Oracle Database 12c Enterprise Edition Release 12.1.0.2.0 - 64bit Production
PL/SQL Release 12.1.0.2.0 - Production
CORE 12.1.0.2.0 Production
TNS for Linux: Version 12.1.0.2.0 - Production
NLSRTL Version 12.1.0.2.0 - Production

We are in the process of setting up audit vault to collect the from the unified audit vault in our database.

We have a requirement that we need to copy some of the data from unified_audit_trail to a custom table before transferring to audit vault and purging. The procedure below works fine when the audit vault collector/agent is running.

   PROCEDURE CopyAndPurgeAuditData
   AS
   BEGIN      
      SaveNewAuditLogs;
      dbms_audit_mgmt.CLEAN_AUDIT_TRAIL(audit_trail_type => dbms_audit_mgmt.AUDIT_TRAIL_UNIFIED, use_last_arch_timestamp => TRUE);
      dbms_audit_mgmt.set_last_archive_timestamp(audit_trail_type => dbms_audit_mgmt.AUDIT_TRAIL_UNIFIED, last_archive_time => SYSDATE);
   END;

However, when the collector is not running on the server, the data in my local unified_audit_trail is purged, but no data is transferred to audit vault.

So my question is:

How can I from within plsql detect if the collector is running or not?

In Advanced Queuing (AQ) I can run this statement to find if the agent is up and running or not:

SELECT * FROM mgw_gateway;

Is there something like that for Audit Vault?

I think (haven't tested) that the purge job that is created by dbms_audit_mgmt.create_purge_job is aware if the collector/agent is running or not and will not purge locally if audit data cannot be transferred to the Audit Vault database.

If so is the case, would it be possible to do the purging by manually starting the job created by dbms_audit_mgmt.create_purge_job ? The procedure SaveNewAuditLogs; in the code snippet above can run multiple times. What I am worried about is to lose data when purging when collector/agent on server is not running.

Please let me know if you need more information from me.

Thanks in advance for help!