Even though audit_trail=DB and audit_sys_operations=FLASE in my 11g (both R2 and R1) databases, I still find a number of small audit files in audit dest folder. This is the default behaviour and if I'm not wrong cannot be disabled.
I can use DBMS_AUDIT_MGMT package to purge records in aud$ just fine. But it doesn't purge the files generated above. The documentation states with proper audit_dest_type=AUDIT_TRAIL_OS it should, but my own testing shows it doesn't.
Has anyone any experience about this?
http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/auditing.htm#BCGJFEEE
[oracle@server adump]$ ls *aud |wc -l
2360
BEGIN
sys.DBMS_AUDIT_MGMT.INIT_CLEANUP(
audit_trail_type => sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS,
default_cleanup_interval => 24 /* hours */);
END;
/
BEGIN
sys.DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(
audit_trail_type => sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS,
last_archive_time => systimestamp - interval '32' day);
END;
/
BEGIN
sys.DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_PROPERTY(
AUDIT_TRAIL_TYPE => sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS,
AUDIT_TRAIL_PROPERTY => sys.DBMS_AUDIT_MGMT.OS_FILE_MAX_AGE,
AUDIT_TRAIL_PROPERTY_VALUE => 32 );
END;
/
BEGIN
sys.DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
AUDIT_TRAIL_TYPE => sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_OS,
USE_LAST_ARCH_TIMESTAMP => TRUE);
END;
/
[oracle@server adump]$ ls *aud |wc -l
2362
Edit -- OS is linux RHEL 5