Re: Auditing

Hi,

Oracle used to sanction moving aud$ and then they didn't sanction it anymore. Not sure what they current view on moving it is - probably best to simply ask. This was discussed on comp.databases.oracle.server last year 8/9/03 and this is what i answered then if it helps:

<quote>

You mention moving sys.aud$ to another tablespace, whilst this is common sense Oracle no longer support doing this as some poor customer could not recover when this had been done. I don't believe Oracle have changed advice on this as yet. There is a note on Metalink about it. The solution if it is moved is probably to switch audit off whilst recovering. Jonathan discussed the following with me some time back:

<snip>

I haven't done any tests on the theory - it was just a surmise that when the complainant was trying recovery, they needed to recover the tablespace with the aud$ table in it, but were running with audit on, so the recovery processes couldn't log themselves until after the recovery had completed.
</snip>

kind regards

Pete
<quote>

The snip section was Jonathan Lewis's thoughts on this to me.

hth

kind regards

Pete

-- 
Pete Finnigan
email:pete_at_petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.

----------------------------------------------------------------
Please see the official ORACLE-L FAQ: http://www.orafaq.com
----------------------------------------------------------------
To unsubscribe send email to:  oracle-l-request_at_freelists.org
put 'unsubscribe' in the subject line.
--
Archives are at http://www.freelists.org/archives/oracle-l/
FAQ is at http://www.freelists.org/help/fom-serve/cache/1.html
-----------------------------------------------------------------