QUESTION 208-UNIFIED_AUDIT_TRAIL

While investigating a possible security breach, you realized that some audit records were not retrieved  when the UNIFIED_AUDIT_TRAIL view was queried.

How can you ensure that all available audit records are returned when the audit trail is queried?

A. Configure the IMMEDIATE write mode using the DBMS_AUDIT_MGMT.  SET_AUDIT_TRAIL_PROPERTY procedure before querying the UNIFIED_AUDIT_TRAIL view.

B. Execute the DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL procedure before querying the  UNIFIED_AUDIT_TRAIL view.

C. Query the V$UNIFIED_AUDIT_TRAIL view rather than the UNIFIED AUDIT_TRAIL view.

D. Enable the OS auditing option in the database before querying the UNIFIED_AUDIT_TRAIL view.

Correct Answer: B

让审计写入到磁盘里面去：

exec dbms_audit_mgmt.flash_unfied_audit_trail

写入模式有两种： 队列模式，当队列满了时，统一批次写入磁盘；立即写入模式，有一条写一条。

注意： 12c里面采用的是统一审计： unified audit