I observe following auditing parameters set on my database.
audit_sys_operations parameter is set to FALSE but still I see SYS auditing files getting generated in $ORACLE_HOME/rdbms/audit
Interestingly in alert log, with every startup of the database I see the following comment
SYS auditing is disabled
Starting up ORACLE RDBMS Version: 188.8.131.52.0.
Why are sys auditing files getting generated then? Since there are some cronjobs scheduled to run every 15mins connected as sys, huge number of files are getting egnerated every day and I would like this to get disabled.
This is an inbuilt auditing by Oracle introduced from Oracle 9.2.X in order to meet more stringent requirements for security. Before 9.2.X , if a user connects as sysdba there is no trace of his or her activities in the audit table.
The parameter audit_sys_operations in init.ora is set to false , despite this the audit files will be generated in $ORACLE_HOME/rdbms/audit for every connection as sysdba. If it is set to TRUE the statements performed by SYSDBA will also be recorded.