Menu Close

Disabling and Dropping Audit Policies (unified) on 12c

1> Show the enabled policies:

SQL> COL USER_NAME FOR A10
SQL> COL POLICY_NAME FOR A20
SQL> COL SUCCESS FOR A8
SQL> COL FAILURE FOR A8
SQL> COL ENTITY_NAME FOR A20
SQL> SET LINES 200
SQL> SELECT * FROM AUDIT_UNIFIED_ENABLED_POLICIES;
USER_NAME  POLICY_NAME   ENABLED ENABLED_OPTION  ENTITY_NAME  ENTITY_ SUCCESS  FAILURE
---------- --------------------- --------------- ------------ ------- -------- --------
ALL USERS  TEST_POLICY2  BY      BY USER         ALL USERS    USER    YES      YES
ALL USERS  TEST_POLICY1  BY      BY USER         ALL USERS    USER    YES      YES

2> Flush the Audit Trail:

SQL> EXEC DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL(FLUSH_TYPE => DBMS_AUDIT_MGMT.FLUSH_ALL_INSTANCES);

3> Clean the Audit Trail:

SQL> BEGIN
	DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
	AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
	USE_LAST_ARCH_TIMESTAMP => FALSE);
     END;
     /

Note: This might get an error -> ORA-00054: resource busy and acquire with NOWAIT specified or timeout expired. In that case, just apply the conventional lock resolve – kill session etc. techniques…

4> Disable:

SQL> NOAUDIT POLICY TEST_POLICY1;
SQL> NOAUDIT POLICY TEST_POLICY2;

5> Drop:

SQL> DROP AUDIT POLICY TEST_POLICY1;
SQL> DROP AUDIT POLICY TEST_POLICY2;

6> Re-Check:

SQL> SELECT * FROM AUDIT_UNIFIED_ENABLED_POLICIES;	
-- No Rows...

Posted in Security

Related Posts