ORACLE AUDITING

For 12c the default location is
$ORACLE_BASE/audit/$ORACLE_SID

select parameter, value from v$option  where parameter='Unified Auditing';

--Check enabled policies
select * from audit_unified_enabled_policies;

ALL USERS ORA_SECURECONFIG BY BY USER ALL USERS USER YES YES

ALL USERS ORA_LOGON_FAILURES BY BY USER ALL USERS USER NO YES

-- What does the policy do?

SELECT AUDIT_OPTION FROM AUDIT_UNIFIED_POLICIES WHERE POLICY_NAME='ORA_SECURECONFIG';

CREATE PLUGGABLE DATABASE

ALTER PLUGGABLE DATABASE

DROP PLUGGABLE DATABASE

ALTER DATABASE DICTIONARY

--Another helpful thing

SELECT * FROM DBA_AUDIT_MGMT_CONFIG_PARAMS;

DB AUDIT TABLESPACE SYSAUX STANDARD AUDIT TRAIL

DB AUDIT TABLESPACE SYSAUX FGA AUDIT TRAIL

DB AUDIT TABLESPACE SYSAUX UNIFIED AUDIT TRAIL

AUDIT FILE MAX SIZE 10000 OS AUDIT TRAIL

--Best Practice 
Create new tablespace for audit

Example:
create tablespace aud_tbs datafile '/u02/app/oracle/oradata/EPCHRS/aud_tbs.dbf'
size 500k reuse
autoextend on next 500k maxsize 100M;


--Transfer
BEGIN
DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION(
AUDIT_TRAIL_TYPE=>DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
AUDIT_TRAIL_LOCATION_VALUE=>'AUD_TBS');
END;