STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

DISA Rule

SV-270506r1167744_rule

Vulnerability Number

V-270506

Group Title

SRG-APP-000357-DB-000316

Rule Version

O19C-00-005700

Severity

CAT II

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

Allocate sufficient audit file/table space to support peak demand.

If audit records are being written to the table sys.aud$, create a new tablespace dedicated to the AUD$ table and move AUD$ using the statement below:

exec sys.dbms_audit_mgmt.move_dbaudit_tables('<tablespace_name>');

Ensure that audit tables are in their own tablespaces and that the tablespaces have enough room for the volume of log data that will be produced.

Detailed procedures for how to alter the tablespace for audit logs can be found here:
https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/ALTER-TABLESPACE.html.

Check Contents

Review the DBMS settings to determine whether audit logging is configured to produce logs consistent with the amount of space allocated for logging. If auditing will generate excessive logs so that they may outgrow the space reserved for logging, this is a finding.

If file-based auditing is in use, check that sufficient space is available to support the file(s). If not, this is a finding.

If standard, table-based auditing is used, the audit logs are written to a table called AUD$; and if a Virtual Private Database is deployed, a table is created called FGA_LOG$.

sqlplus connect as sysdba

SELECT table_name, tablespace_name
FROM dba_tables
WHERE table_name IN ('AUD$')
ORDER BY table_name;

TABLE_NAME TABLESPACE_NAME
----------------------------- ------------------------------
AUD$ SYSTEM

The AUD$ table should be in its own tablespace. If the tablespace name is SYSTEM, this is a finding.

Check the current location of the audit trail tables:

SELECT inst_id, con_id, name, value
FROM sys.gv_$parameter
WHERE name IN ('audit_file_dest', 'unified_audit_systemlog');

Verify adequate space is allocated for the audit trail location.

If Unified Auditing is used:

Audit logs are written to tables in the AUDSYS schema. The default tablespace for AUDSYS is USERS, and it should be in its own tablespace.

If the tablespace name is USERS, this is a finding.

Investigate whether there have been any incidents where the DBMS ran out of audit log space since the last time the space was allocated or other corrective measures were taken. If there have been, this is a finding.

Vulnerability Number

V-270506

Documentable

False

Rule Version

O19C-00-005700

Severity Override Guidance

Review the DBMS settings to determine whether audit logging is configured to produce logs consistent with the amount of space allocated for logging. If auditing will generate excessive logs so that they may outgrow the space reserved for logging, this is a finding.

If file-based auditing is in use, check that sufficient space is available to support the file(s). If not, this is a finding.

If standard, table-based auditing is used, the audit logs are written to a table called AUD$; and if a Virtual Private Database is deployed, a table is created called FGA_LOG$.

sqlplus connect as sysdba

SELECT table_name, tablespace_name
FROM dba_tables
WHERE table_name IN ('AUD$')
ORDER BY table_name;

TABLE_NAME TABLESPACE_NAME
----------------------------- ------------------------------
AUD$ SYSTEM

The AUD$ table should be in its own tablespace. If the tablespace name is SYSTEM, this is a finding.

Check the current location of the audit trail tables:

SELECT inst_id, con_id, name, value
FROM sys.gv_$parameter
WHERE name IN ('audit_file_dest', 'unified_audit_systemlog');

Verify adequate space is allocated for the audit trail location.

If Unified Auditing is used:

Audit logs are written to tables in the AUDSYS schema. The default tablespace for AUDSYS is USERS, and it should be in its own tablespace.

If the tablespace name is USERS, this is a finding.

Investigate whether there have been any incidents where the DBMS ran out of audit log space since the last time the space was allocated or other corrective measures were taken. If there have been, this is a finding.

Check Content Reference

M

Target Key

5672