ALTER SYSTEM SET AUDIT_FILE_DEST='/audit_logs' SCOPE=SPFILE;

chown -R oracle:dba /audit_logs

SELECT * FROM dba_audit_trail WHERE action_name LIKE '%SQL%' 
INTO OUTFILE '/your/path/to/file.csv' FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"';

sqlplus / as sysdba

SQL> SHOW PARAMETER AUDIT

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /data/app/oracle/admin/orcl/ad
                                                 ump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      DB

ALTER SYSTEM SET AUDIT_TRAIL='NONE' SCOPE=SPFILE;

SQL> shutdown immediate;
SQL> startup;

SQL> show parameter audit_trail

NAME TYPE VALUE

audit_trail string FALSE

SQL> alter system set audit_sys_operations=TRUE scope=spfile;--審計管理用戶(以sysdba/sysoper角色登陸)
SQL> alter system set audit_trail=db,extended scope=spfile; -- 這是將審計數(shù)據(jù)放入數(shù)據(jù)庫中
SQL> ALTER SYSTEM SET audit_trail='xml' SCOPE=spfile; -- 這是將審計數(shù)據(jù)放入xml文件中

查詢目前的日志信息：select * FROM SYS.AUD$;
刪除已有的審計信息：DELETE FROM SYS.AUD$;

truncate table SYS.AUD$;