audit

[Roshan]

Hello Erman,

we noticed a table has been truncated on DB. DB is in noarchivelog mode.. hence logminer would not be efficient.

Auditing has been enabled on DB.

I checked the audit table, but i saw not entries (truncate/delete).

Kindly advise.

20221122_184857.jpg

Regards,

Roshan

[ErmanArslansOracleBlog]

Do you have the required audit config for auditing those truncate command?
I mean, did you issued "AUDIT TABLE" commands while configuring your audit mechanism?
If so, there should be a record for that op in your audit log.. Otherwise; you won't see any audit records there.

FACT:

 "AUDIT TABLE" audits the CREATE TABLE, TRUNCATE TABLE, COMMENT ON TABLE, ALTER TABLE,  DROP TABLE and DELETE [FROM] TABLE statements.

AUDIT TABLE audit option would capture the truncate table and drop table commands executed, even by the object owner.

Reference: How to Audit Truncate Table command? (Doc ID 2202398.1)