{"id":9532,"date":"2016-12-09T15:44:55","date_gmt":"2016-12-09T14:44:55","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/"},"modified":"2016-12-09T15:44:55","modified_gmt":"2016-12-09T14:44:55","slug":"oracle-12c-rman-and-unified-auditing-does-it-really-work","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/","title":{"rendered":"Oracle 12c &#8211; RMAN and Unified Auditing &#8211; Does it really work?"},"content":{"rendered":"<h2>By William Sescu<\/h2>\n<p>The new Oracle Unified Auditing feature, audits RMAN operation per default as soon as<br \/>\nyou relink your Oracle binary and start your instance. A quite cool new feature, because it allows me<br \/>\nto audit RMAN operation out of the box. For example, someone could create a RMAN backup to &#8216;\/tmp&#8217; and then copy it to somewhere else. And I would like to know that. \ud83d\ude09<\/p>\n<p>Oracle added 5 columns to the unified_audit_trail view only for RMAN, to find out what RMAN operation was done on the database. The new columns are the following.<\/p>\n<ul>\n<li>RMAN_SESSION_RECID<\/li>\n<li>RMAN_SESSION_STAMP<\/li>\n<li>RMAN_OPERATION<\/li>\n<li>RMAN_OBJECT_TYPE<\/li>\n<li>RMAN_DEVICE_TYPE<\/li>\n<\/ul>\n<p>Due to the Oracle documentation, the column description is the following.<\/p>\n<h4>RMAN_SESSION_RECID<\/h4>\n<p>RMAN session identifier. Together with RMAN_SESSION_STAMP uniquely identifies an RMAN job<br \/>\n(note that this is not same as user session ID; the value is a recid in controlfile that identifies RMAN job)<\/p>\n<h4>RMAN_SESSION_STAMP<\/h4>\n<p>Timestamp for the session<\/p>\n<h4>RMAN_OPERATION<\/h4>\n<p>The RMAN operation executed by the job. One row will be added for each distinct operation within an RMAN session. For example, a backup job would contain BACKUP in the RMAN_OPERATION column.<\/p>\n<h4>RMAN_OBJECT_TYPE<\/h4>\n<p>Type of objects involved for backup or restore\/recover or change\/delete\/crosscheck commands. It contains one of the following values. If RMAN command does not satisfy one of them, \u00a0then preference is given in order, from top to bottom of the list:<\/p>\n<ul>\n<li>DB FULL<\/li>\n<li>RECVR AREA<\/li>\n<li>DB INCR<\/li>\n<li>DATAFILE FULL<\/li>\n<li>DATAFILE INCR<\/li>\n<li>ARCHIVELOG<\/li>\n<li>CONTROLFILE<\/li>\n<li>SPFILE<\/li>\n<\/ul>\n<h4>RMAN_DEVICE_TYPE<\/h4>\n<p>Device involved in the RMAN job. It may be DISK or SBT_TAPE or * \u00a0(An * indicates that more than one location is involved). For a backup job, it will be the output device type. For other commands (such as restore or crosscheck), \u00a0it will be the input device type.<\/p>\n<p>Ok. Let&#8217;s start with a first test. Just for the protocol, I am using here 12cR1 PSU Oct 2016.<\/p>\n<p>First of all, I am activating the &#8220;immediate-write&#8221; feature, meaning that audit records are written immediately, \u00a0and not to the audit buffer first.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">SQL&gt; select parameter, value from v$option where parameter like '%Unified%';\n\nPARAMETER              VALUE\n---------------------- --------\nUnified Auditing       TRUE\n\n-- Modify OUA to use the immediate-write mode\n\nSQL&gt; BEGIN\n  2  DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_PROPERTY(\n  3  DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,\n  4  DBMS_AUDIT_MGMT.AUDIT_TRAIL_WRITE_MODE,\n  5  DBMS_AUDIT_MGMT.AUDIT_TRAIL_IMMEDIATE_WRITE);\n  6  END;\n  7  \/\n\nPL\/SQL procedure successfully completed.\n\nSQL&gt; select * from DBA_AUDIT_MGMT_CONFIG_PARAMS where PARAMETER_NAME = 'AUDIT WRITE MODE';\n\nPARAMETER_NAME                   PARAMETER_VALUE        AUDIT_TRAIL\n-------------------------------- ---------------------- ----------------------------\nAUDIT WRITE MODE                 IMMEDIATE WRITE MODE   UNIFIED AUDIT TRAIL<\/pre>\n<p>&nbsp;<\/p>\n<p>Ok. Cool. So far so good. Let&#8217;s start a RMAN backup job now.<\/p>\n<p>&nbsp;<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">oracle@dbidg01:\/home\/oracle\/ [DBIT121] rman target \/\n\nRecovery Manager: Release 12.1.0.2.0 - Production on Fri Dec 9 15:59:44 2016\n\nCopyright (c) 1982, 2014, Oracle and\/or its affiliates.  All rights reserved.\n\nconnected to target database: DBIT121 (DBID=172831209)\n\nRMAN&gt; backup database plus archivelog delete input;\nStarting backup at 09-DEC-2016 16:03:41\ncurrent log archived\nusing target database control file instead of recovery catalog\nallocated channel: ORA_DISK_1\nchannel ORA_DISK_1: SID=12 device type=DISK\nchannel ORA_DISK_1: starting archived log backup set\nchannel ORA_DISK_1: specifying archived log(s) in backup set\ninput archived log thread=1 sequence=22 RECID=6 STAMP=930153822\nchannel ORA_DISK_1: starting piece 1 at 09-DEC-2016 16:03:43\nchannel ORA_DISK_1: finished piece 1 at 09-DEC-2016 16:03:44\npiece handle=\/u03\/fast_recovery_area\/DBIT121_SITE1\/backupset\/2016_12_09\/o1_mf_annnn_TAG20161209T160342_d4okyh1t_.bkp tag=TAG20161209T160342 comment=NONE\nchannel ORA_DISK_1: backup set complete, elapsed time: 00:00:01\nchannel ORA_DISK_1: deleting archived log(s)\narchived log file name=\/u03\/fast_recovery_area\/DBIT121_SITE1\/archivelog\/2016_12_09\/o1_mf_1_22_d4okyfo5_.arc RECID=6 STAMP=930153822\nFinished backup at 09-DEC-2016 16:03:44\n\nStarting backup at 09-DEC-2016 16:03:44\nusing channel ORA_DISK_1\nchannel ORA_DISK_1: starting full datafile backup set\nchannel ORA_DISK_1: specifying datafile(s) in backup set\ninput datafile file number=00005 name=\/u02\/oradata\/DBIT121_SITE1\/datafile\/o1_mf_example_d4fjz1fz_.dbf\ninput datafile file number=00001 name=\/u02\/oradata\/DBIT121_SITE1\/datafile\/o1_mf_system_d4fjt03j_.dbf\ninput datafile file number=00003 name=\/u02\/oradata\/DBIT121_SITE1\/datafile\/o1_mf_sysaux_d4fjrlvs_.dbf\ninput datafile file number=00004 name=\/u02\/oradata\/DBIT121_SITE1\/datafile\/o1_mf_undotbs1_d4fjvtd1_.dbf\ninput datafile file number=00006 name=\/u02\/oradata\/DBIT121_SITE1\/datafile\/o1_mf_users_d4fjvqb1_.dbf\nchannel ORA_DISK_1: starting piece 1 at 09-DEC-2016 16:03:44\nchannel ORA_DISK_1: finished piece 1 at 09-DEC-2016 16:05:19\npiece handle=\/u03\/fast_recovery_area\/DBIT121_SITE1\/backupset\/2016_12_09\/o1_mf_nnndf_TAG20161209T160344_d4okyjny_.bkp tag=TAG20161209T160344 comment=NONE\nchannel ORA_DISK_1: backup set complete, elapsed time: 00:01:35\nchannel ORA_DISK_1: starting full datafile backup set\nchannel ORA_DISK_1: specifying datafile(s) in backup set\nincluding current control file in backup set\nincluding current SPFILE in backup set\nchannel ORA_DISK_1: starting piece 1 at 09-DEC-2016 16:05:20\nchannel ORA_DISK_1: finished piece 1 at 09-DEC-2016 16:05:21\npiece handle=\/u03\/fast_recovery_area\/DBIT121_SITE1\/backupset\/2016_12_09\/o1_mf_ncsnf_TAG20161209T160344_d4ol1jnj_.bkp tag=TAG20161209T160344 comment=NONE\nchannel ORA_DISK_1: backup set complete, elapsed time: 00:00:01\nFinished backup at 09-DEC-2016 16:05:21\n\nStarting backup at 09-DEC-2016 16:05:21\ncurrent log archived\nusing channel ORA_DISK_1\nchannel ORA_DISK_1: starting archived log backup set\nchannel ORA_DISK_1: specifying archived log(s) in backup set\ninput archived log thread=1 sequence=23 RECID=7 STAMP=930153921\nchannel ORA_DISK_1: starting piece 1 at 09-DEC-2016 16:05:21\nchannel ORA_DISK_1: finished piece 1 at 09-DEC-2016 16:05:23\npiece handle=\/u03\/fast_recovery_area\/DBIT121_SITE1\/backupset\/2016_12_09\/o1_mf_annnn_TAG20161209T160521_d4ol1ktz_.bkp tag=TAG20161209T160521 comment=NONE\nchannel ORA_DISK_1: backup set complete, elapsed time: 00:00:02\nchannel ORA_DISK_1: deleting archived log(s)\narchived log file name=\/u03\/fast_recovery_area\/DBIT121_SITE1\/archivelog\/2016_12_09\/o1_mf_1_23_d4ol1kpj_.arc RECID=7 STAMP=930153921\nFinished backup at 09-DEC-2016 16:05:23\n\nRMAN&gt;<\/pre>\n<p>&nbsp;<\/p>\n<p>After my RMAN Backup has finished, I open another session and checked the unified_audit_trail, but nothing is there.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">SQL&gt; select EVENT_TIMESTAMP, ACTION_NAME, RMAN_SESSION_RECID,\n  2  RMAN_SESSION_STAMP, RMAN_OPERATION, RMAN_OBJECT_TYPE, RMAN_DEVICE_TYPE\n  3  from unified_audit_trail where ACTION_NAME like '%RMAN%' order by 1;\n\nno rows selected<\/pre>\n<p>Now I do a clean exit of my RMAN session, and here we go. Now I have an audit entry, saying that a RMAN backup to disk took place. Perfect, this is exactly what I wanted to see.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">...\nRMAN&gt; exit\n\nRecovery Manager complete.\n\n\nSQL&gt; select EVENT_TIMESTAMP, ACTION_NAME, RMAN_SESSION_RECID,\n  2  RMAN_SESSION_STAMP, RMAN_OPERATION, RMAN_OBJECT_TYPE, RMAN_DEVICE_TYPE\n  3  from unified_audit_trail where ACTION_NAME like '%RMAN%' order by 1;\n\nEVENT_TIMESTAMP              ACTION_NAME    RMAN_SESSION_RECID RMAN_SESSION_STAMP RMAN_OPERATION       RMAN_OBJECT_TYPE     RMAN_\n---------------------------- -------------- ------------------ ------------------ -------------------- -------------------- -----\n09-DEC-16 04.08.10.532931 PM RMAN ACTION                    22          930153584 Backup               DB Full              Disk<\/pre>\n<p>&nbsp;<\/p>\n<p>This brings me to an idea. What happens if a Hacker logs into my system, starts a RMAN backup, and kills his own RMAN session, after the backup has finished? Sounds crazy, but Hackers are usually very creative.<\/p>\n<p>Ok. The Hacker logs in now, and because the Hacker is smart, he gives his RMAN backup a TAG, so it is easier to delete it afterwards.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">oracle@dbidg01:\/home\/oracle\/ [DBIT121] rman target \/\n\nRecovery Manager: Release 12.1.0.2.0 - Production on Fri Dec 9 16:09:58 2016\n\nCopyright (c) 1982, 2014, Oracle and\/or its affiliates.  All rights reserved.\n\nconnected to target database: DBIT121 (DBID=172831209)\n\nRMAN&gt; alter system archive log current;\n\nusing target database control file instead of recovery catalog\nStatement processed\n\nRMAN&gt; backup archivelog all format '\/tmp\/%U' TAG 'HACKER';\n\nStarting backup at 09-DEC-2016 16:11:58\ncurrent log archived\nallocated channel: ORA_DISK_1\nchannel ORA_DISK_1: SID=12 device type=DISK\nchannel ORA_DISK_1: starting archived log backup set\nchannel ORA_DISK_1: specifying archived log(s) in backup set\ninput archived log thread=1 sequence=24 RECID=8 STAMP=930154279\ninput archived log thread=1 sequence=25 RECID=9 STAMP=930154318\nchannel ORA_DISK_1: starting piece 1 at 09-DEC-2016 16:11:59\nchannel ORA_DISK_1: finished piece 1 at 09-DEC-2016 16:12:00\npiece handle=\/tmp\/0ern21qf_1_1 tag=HACKER comment=NONE\nchannel ORA_DISK_1: backup set complete, elapsed time: 00:00:01\nFinished backup at 09-DEC-2016 16:12:00<\/pre>\n<p>&nbsp;<\/p>\n<p>At this point, still no further entry in the unified_audit_trail.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">SQL&gt; r\n  1  select EVENT_TIMESTAMP, ACTION_NAME, RMAN_SESSION_RECID,\n  2  RMAN_SESSION_STAMP, RMAN_OPERATION, RMAN_OBJECT_TYPE, RMAN_DEVICE_TYPE\n  3* from unified_audit_trail where ACTION_NAME like '%RMAN%' order by 1\n\nEVENT_TIMESTAMP              ACTION_NAME    RMAN_SESSION_RECID RMAN_SESSION_STAMP RMAN_OPERATION       RMAN_OBJECT_TYPE     RMAN_\n---------------------------- -------------- ------------------ ------------------ -------------------- -------------------- -----\n09-DEC-16 04.08.10.532931 PM RMAN ACTION                    22          930153584 Backup               DB Full              Disk<\/pre>\n<p>Meanwhile, the Hacker copies the data away, and because the Hacker is a good boy, he cleans up everything afterwards. \ud83d\ude42<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">RMAN&gt; delete noprompt backuppiece tag=HACKER;\n\nusing channel ORA_DISK_1\n\nList of Backup Pieces\nBP Key  BS Key  Pc# Cp# Status      Device Type Piece Name\n------- ------- --- --- ----------- ----------- ----------\n14      14      1   1   AVAILABLE   DISK        \/tmp\/0ern21qf_1_1\ndeleted backup piece\nbackup piece handle=\/tmp\/0ern21qf_1_1 RECID=14 STAMP=930154319\nDeleted 1 objects<\/pre>\n<p>At the moment, there is still nothing new in the unified_audit_trail. Now, to avoid entries into the unified_audit_trail view, the hacker kills his own session.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">oracle@dbidg01:\/tmp\/ [DBIT121] ps -ef | grep rman | grep -v grep\noracle    8829  2839  0 16:09 pts\/1    00:00:00 rman target \/\noracle@dbidg01:\/tmp\/ [DBIT121] kill -9 8829\n\n\n...\nRMAN&gt; Killed<\/pre>\n<p>And now the 1Million Dollar question &#8230; do we have a new entry or not?<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">SQL&gt; r\n  1  select EVENT_TIMESTAMP, ACTION_NAME, RMAN_SESSION_RECID,\n  2  RMAN_SESSION_STAMP, RMAN_OPERATION, RMAN_OBJECT_TYPE, RMAN_DEVICE_TYPE\n  3* from unified_audit_trail where ACTION_NAME like '%RMAN%' order by 1\n\nEVENT_TIMESTAMP              ACTION_NAME    RMAN_SESSION_RECID RMAN_SESSION_STAMP RMAN_OPERATION       RMAN_OBJECT_TYPE     RMAN_\n---------------------------- -------------- ------------------ ------------------ -------------------- -------------------- -----\n09-DEC-16 04.08.10.532931 PM RMAN ACTION                    22          930153584 Backup               DB Full              Disk<\/pre>\n<p>No, no new entry. This entry is still the one from my regular RMAN backup with the clean exit.<\/p>\n<h3>Conclusion<\/h3>\n<p>Don&#8217;t rely too much on the unified_audit_trail records, in case you want to audit RMAN backups.<\/p>\n<p>Cheers,<br \/>\nWilliam<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>By William Sescu The new Oracle Unified Auditing feature, audits RMAN operation per default as soon as you relink your Oracle binary and start your instance. A quite cool new feature, because it allows me to audit RMAN operation out of the box. For example, someone could create a RMAN backup to &#8216;\/tmp&#8217; and then [&hellip;]<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[209],"type_dbi":[],"class_list":["post-9532","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","tag-oracle-12c"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Oracle 12c - RMAN and Unified Auditing - Does it really work? - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Oracle 12c - RMAN and Unified Auditing - Does it really work?\" \/>\n<meta property=\"og:description\" content=\"By William Sescu The new Oracle Unified Auditing feature, audits RMAN operation per default as soon as you relink your Oracle binary and start your instance. A quite cool new feature, because it allows me to audit RMAN operation out of the box. For example, someone could create a RMAN backup to &#8216;\/tmp&#8217; and then [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-12-09T14:44:55+00:00\" \/>\n<meta name=\"author\" content=\"Oracle Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oracle Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\"},\"author\":{\"name\":\"Oracle Team\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"headline\":\"Oracle 12c &#8211; RMAN and Unified Auditing &#8211; Does it really work?\",\"datePublished\":\"2016-12-09T14:44:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\"},\"wordCount\":626,\"commentCount\":2,\"keywords\":[\"Oracle 12c\"],\"articleSection\":[\"Database Administration &amp; Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\",\"name\":\"Oracle 12c - RMAN and Unified Auditing - Does it really work? - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"datePublished\":\"2016-12-09T14:44:55+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Oracle 12c &#8211; RMAN and Unified Auditing &#8211; Does it really work?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\",\"name\":\"Oracle Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"caption\":\"Oracle Team\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Oracle 12c - RMAN and Unified Auditing - Does it really work? - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/","og_locale":"en_US","og_type":"article","og_title":"Oracle 12c - RMAN and Unified Auditing - Does it really work?","og_description":"By William Sescu The new Oracle Unified Auditing feature, audits RMAN operation per default as soon as you relink your Oracle binary and start your instance. A quite cool new feature, because it allows me to audit RMAN operation out of the box. For example, someone could create a RMAN backup to &#8216;\/tmp&#8217; and then [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/","og_site_name":"dbi Blog","article_published_time":"2016-12-09T14:44:55+00:00","author":"Oracle Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oracle Team","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/"},"author":{"name":"Oracle Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"headline":"Oracle 12c &#8211; RMAN and Unified Auditing &#8211; Does it really work?","datePublished":"2016-12-09T14:44:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/"},"wordCount":626,"commentCount":2,"keywords":["Oracle 12c"],"articleSection":["Database Administration &amp; Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/","url":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/","name":"Oracle 12c - RMAN and Unified Auditing - Does it really work? - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2016-12-09T14:44:55+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/oracle-12c-rman-and-unified-auditing-does-it-really-work\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Oracle 12c &#8211; RMAN and Unified Auditing &#8211; Does it really work?"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee","name":"Oracle Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","caption":"Oracle Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/9532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=9532"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/9532\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=9532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=9532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=9532"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=9532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}