在Oracle 10g中audit_trail增加了一个新选项:xml，与os选项不同的是，会将审计记录记录到操作系统的xml文件中。

SQL> show parameter audit;

NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /u01/app/oracle/admin/orcl/adu
mp
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string DB
SQL> alter system set audit_trail=xml scope=spfile;

System altered.

SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup;
ORACLE instance started.

Total System Global Area 292278272 bytes
Fixed Size 2143784 bytes
Variable Size 222300632 bytes
Database Buffers 62914560 bytes
Redo Buffers 4919296 bytes
Database mounted.
Database opened.
SQL>
SQL> show parameter audit;

NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /u01/app/oracle/admin/orcl/adu
mp
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string XML
SQL> alter table zlhis.test add col5 varchar2(20);

Table altered.

SQL> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.1.0.6.0 - 64bit Production
With the Partitioning, Real Application Clusters, OLAP, Data Mining
and Real Application Testing options
[oracle@rac1 adump]$ cd /u01/app/oracle/admin/orcl/adump
[oracle@rac1 adump]$ ll
total 52
-rw-r--r-- 1 oracle oinstall 235 Aug 6 16:51 adx_orcl1.txt
-rw-r----- 1 oracle oinstall 692 Aug 6 16:48 ora_15493.aud
-rw-r----- 1 oracle oinstall 699 Aug 6 16:48 ora_15622.aud
-rw-rw---- 1 oracle oinstall 694 Aug 6 16:48 ora_15715.aud
-rw-r----- 1 oracle oinstall 829 Aug 6 16:49 ora_15769.aud
-rw-rw---- 1 oracle oinstall 687 Aug 6 16:48 ora_15780.aud
-rw-rw---- 1 oracle oinstall 687 Aug 6 16:49 ora_16324.aud
-rw-r----- 1 oracle oinstall 692 Aug 6 16:50 ora_16642.aud
-rw-r--r-- 1 oracle oinstall 708 Aug 6 16:50 ora_16752.xml
-rw-rw---- 1 oracle oinstall 682 Aug 6 16:50 ora_16836.xml
-rw-r--r-- 1 oracle oinstall 708 Aug 6 16:51 ora_16885.xml
-rw-rw---- 1 oracle oinstall 673 Aug 6 16:50 ora_16909.xml
-rw-rw---- 1 oracle oinstall 673 Aug 6 16:51 ora_17430.xml

[oracle@rac1 adump]$ vi ora_17430.xml

http://xmlns.oracle.com/oracleas/schema/dbserver_audittrail-11_1.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.oracle.com/oracleas/schema/dbserver_audittrail-11_1.xsd">
11.1
812008-08-06T16:51:33.367108/oraclerac11743010SYSDBA

CONNECT