Difference between standard and unified auditing?
In the evolution of Oracle Database, auditing has moved from a fragmented, complex chore to a streamlined, high-performance machine. If you are working in any version from 12c through 23c (and into 2026), you are likely standing at the crossroads of Traditional (Standard) Auditing and Unified Auditing.
Here is the breakdown of why one is a relic of the past and the other is the future.
In the old model, audit records were "homeless." Depending on what you were auditing, the data ended up in different places:
Standard audit records went to the SYS.AUD$ table.
Fine-Grained Auditing (FGA) records went to SYS.FGA_LOG$.
Database Vault, RMAN, and Data Pump had their own separate logs.
OS-level audits went to .aud files in a folder on the server.
As the name suggests, everything is unified. All audit data from every source—RMAN, Label Security, Database Vault, and standard SQL activity—is funneled into a single, secure, read-only table in the AUDSYS schema.
One of the biggest complaints about Traditional Auditing was the "performance tax."
Traditional: When a user performed an audited action, the database had to write that audit record to disk at the same time (synchronously). This slowed down every transaction.
Unified: It uses a queued, asynchronous write process. Audit records are staged in memory and written to the audit trail by a background process. This significantly reduces the impact on the user’s experience.
| Feature | Traditional Auditing | Unified Auditing |
| Logic | You audit specific statements (e.g., AUDIT TABLE). | You create Policies (a collection of rules). |
| Flexibility | Limited. It's hard to say "Audit X only if Y is true." | Highly flexible. You can audit based on roles, context, or specific actions. |
| Storage | Lives in the SYSTEM tablespace (dangerous if it fills up). | Lives in SYSAUX in a dedicated, partitioned schema. |
| Readability | You have to join 4-5 different views to see the full picture. | One view: UNIFIED_AUDIT_TRAIL. |
In Traditional Auditing, a powerful DBA could potentially delete records from SYS.AUD$ to hide their tracks.
In Unified Auditing, the audit trail is physically located in the AUDSYS schema and is read-only. Even a user with SYSDBA cannot simply "delete" rows from the audit trail using standard SQL. You must use the DBMS_AUDIT_MGMT package, which itself creates—you guessed it—an audit record.
Most modern security regulations (like those requiring "Immutable Logs") effectively force the use of Unified Auditing. Furthermore, in Oracle 23c and beyond, Traditional Auditing is officially deprecated. Moving to Unified Auditing isn't just a "nice to have"; it's a requirement for keeping the database supported and secure.
You can check if your database has been fully "switched over" to the Unified model with this query:
SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';
FALSE: You are in "Mixed Mode" (Traditional is still active).
TRUE: You are in "Pure Unified Mode."
Traditional Auditing is like having five different security cameras, each recording to a different VCR in a different room. Unified Auditing is a modern 4K digital system that streams everything to a single, encrypted cloud server. The choice for a modern DBA is clear.