One requirement our customer has is to keep audit records around for one year. I've always opted to set my auditing to "db, extended" and export a months worth of audit records (encrypted) followed by a truncate so that the aud$ table doesn't get huge. At any time, we could take one or all of those audit_<date>.dmp files and import them into a non-production system for analysis. Do I have to change my approach when going to pure "unified auditing"? I read through the documentation about audsys & unified_audit_trail and it doesn't seem that clear how I would accomplish my same goals. One option appeared to be auditing to the OS and then import those records later; I'm not a huge fan of that because you can't simply use SQL to query and sort the audit records that are in the file-system.