Modern Relational Databases

Information provided includes what events occur (logon/logoff), what database objects are being accessed, what data is queried, etc.

The most common reason for using auditing is to determine when a database user executes some sort of SQL. The SQL statement is logged by the auditing subsystem in the form of a clear text log file, xml file, binary file, audit table(s) or remote system log.

Auditing occurs separately from any transaction – even when a transaction is rolled back, the auditing log will contain records about statements executed if the auditing is configured to do so.

It is extremely important to properly configure auditing by only auditing the events that require monitoring. Auditing has an impact on performance so you shouldn't audit what isn't necessary. In addition, the audit trail (audit data) location should be protected to avoid manipulation by any user. This necessary step ensures accuracy of the logs.

Most modern databases have similar auditing architecture. Auditing should be installed, enabled, and configured to allow the audit data to be examined via SQL query. Let's examine how this is done in three of the most popular databases – Microsoft SQL Server 2008 R2, Oracle Database 11g R2, and Sybase ASE 15.5.

https://www.infosecisland.com/blogview/15529-Native-Auditing-In-Modern-Relational-Database-Management.html