SQL> SHOW PARAMETER AUDIT

NAME TYPE VALUE

------------------------------------ ----------- ------------------------------
audit_file_dest string C:\ORACLE\PRODUCT\10.2.0\ADMIN
\DB10G\ADUMP
audit_sys_operations boolean FALSE
audit_trail string NONE
SQL>

Auditing is disabled by default, but can enabled by setting the AUDIT_TRAIL static
parameter, which has the following allowed values.

AUDIT_TRAIL = { none | os | db | db,extended | xml | xml,extended }

SQL> ALTER SYSTEM SET audit_trail=db SCOPE=SPFILE;

SQL> STARTUP
SQL>

CONNECT sys/password AS SYSDBA

CREATE USER audit_test IDENTIFIED BY password

DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp
QUOTA UNLIMITED ON users;

GRANT connect TO audit_test;

GRANT create table, create procedure TO audit_test;

CONNECT sys/password AS SYSDBA

AUDIT ALL BY audit_test BY ACCESS;

AUDIT SELECT TABLE, UPDATE TABLE, INSERT TABLE, DELETE TABLE BY audit_test BY
ACCESS;
AUDIT EXECUTE PROCEDURE BY audit_test BY ACCESS;

CONN audit_test/password

CREATE TABLE test_tab (

id NUMBER
);

INSERT INTO test_tab (id) VALUES (1);

UPDATE test_tab SET id = id;
SELECT * FROM test_tab;
DELETE FROM test_tab;

DROP TABLE test_tab;

COLUMN username FORMAT A10

COLUMN owner FORMAT A10
COLUMN obj_name FORMAT A10
COLUMN extended_timestamp FORMAT A35

SELECT username,
extended_timestamp,
owner,
obj_name,
action_name
FROM dba_audit_trail
WHERE owner = 'AUDIT_TEST'
ORDER BY timestamp;

AUDIT INSERT, UPDATE, DELETE ON sys.aud$ BY ACCESS;

Fine Grained Auditing (FGA)

CONN sys/password AS sysdba

BEGIN
DBMS_FGA.add_policy(
object_schema => 'AUDIT_TEST',
object_name => 'EMP',
policy_name => 'SALARY_CHK_AUDIT',
audit_condition => 'SAL > 50000',
audit_column => 'SAL');
END;
/

CONN audit_test/password
SELECT sal FROM emp WHERE ename = 'Tim';
SELECT sal FROM emp WHERE ename = 'Larry';

CONN sys/password AS SYSDBA

SELECT sql_text
FROM dba_fga_audit_trail;