Oracle Database Administration: The Essential Refe

Scope of Auditing

The audit facility allows you to specify the scope of the audit action as follows:

BY USER

The SQL statement and system privilege auditing options allow you to specify a specific user to audit (with the BY USER clause of the AUDIT statement). If you do not specify a user, all users are audited by default.

WHENEVER SUCCESSFUL /WHENEVER NOT SUCCESSFUL

All three forms of auditing allow you to specify whether you want auditing to occur at all times, or only whenever the specific action was successful or unsuccessful. The WHENEVER SUCCESSFUL clause allows you to audit who is actually performing a specific action, while WHENEVER NOT SUCCESSFUL allows you to better check on unsuccessful access. Unsuccessful accesses are usually due to insufficient privileges, allowing you to monitor for break-in attempts or for people making unauthorized searches.

BY SESSION/BY ACCESS

All three forms of auditing allow you to specify how often audit records are to be generated. The BY SESSION clause specifies that Oracle is to write a single audit record for every database session, while the BY ACCESS clause tells Oracle to write a record for every action that qualifies. The tradeoff for knowing exactly when every audited action occurs is that BY ACCESS generates many records.