Case q08 · fact

Which Oracle auditing method survives into 26ai and what does Azure SQL offer instead?

Expected: Traditional auditing desupported in 26ai (deprecated 21c) → Unified Auditing; on Azure SQL use Azure SQL Auditing (server/database policies to Log Analytics/Storage); note gaps vs FGA if recorded.

No tools

The model alone, answering from memory.

larger model · 1 turn · 22 s · 16.5k in / 2.3k out

✗ verdict ✗ grounded ✓ cited

Grader: Claims desupport in 23ai; answered from memory, uncited specifics

Answer

Oracle auditing in 26ai vs. Azure SQL auditing

Verdict: Only Unified Auditing carries into Oracle AI Database 26ai. Traditional auditing (the AUDIT_TRAIL parameter, SYS.AUD$, OS/XML audit files) was desupported in 23ai, and 26ai is built on that release. On the Azure side, the replacement is Azure SQL Auditing in SQL Database, or SQL Server Audit in Managed Instance. For threat detection and tamper evidence, add Defender for SQL and Ledger.

Oracle side

Traditional auditing: deprecated in 21c and desupported in 23ai/26ai. You can no longer create or change policies with the old syntax (AUDIT SELECT TABLE… in the traditional style). The legacy AUD$ and FGA_LOG$ data is kept only so you can read it.
What survives:
- Unified audit policies: CREATE AUDIT POLICY and AUDIT POLICY … BY/EXCEPT/WHENEVER SUCCESSFUL.
- A single trail, UNIFIED_AUDIT_TRAIL, stored in AUDSYS.
- Predefined policies such as ORA_SECURECONFIG and ORA_LOGON_LOGOFF.
- Fine-grained auditing (DBMS_FGA), which now writes into the unified trail.
- 23ai added column-level unified audit policies.
Before you migrate: convert any traditional policies still in use with DBMS_AUDIT_MGMT and the conversion scripts. Otherwise you lose audit coverage when you upgrade to 23ai/26ai, whether or not you move to Azure.
Docs: Oracle Database Security Guide, "Auditing" (https://docs.oracle.com/en/database/oracle/oracle-database/23/dbseg/), and the 23ai Upgrade Guide's desupported-features section (https://docs.oracle.com/en/database/oracle/oracle-database/23/upgrd/).

Azure equivalents

Oracle feature	Azure SQL Database	Azure SQL Managed Instance
Unified audit policies	Server- or database-level Auditing using audit action groups (e.g. `SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP`, `DATABASE_OBJECT_CHANGE_GROUP`, `BATCH_COMPLETED_GROUP`), configured in the Portal, ARM/Bicep, PowerShell or CLI	Full T-SQL `CREATE SERVER AUDIT` plus server and database audit specifications
Audit destination (`UNIFIED_AUDIT_TRAIL`)	Azure Storage (`.xel` files), Log Analytics, or Event Hubs	`TO URL` (Storage) or `TO EXTERNAL_MONITOR` (Log Analytics/Event Hubs)
`DBMS_FGA` conditional auditing	Partial: a predicate filter (`-PredicateExpression` in `Set-AzSqlServerAudit`). It cannot run a handler procedure or audit specific columns the way FGA does.	`WHERE` predicate on `CREATE SERVER AUDIT`
Querying the trail	`sys.fn_get_audit_file()`, or KQL in Log Analytics or Sentinel	Same
Tamper evidence / anomaly detection	Ledger tables; Microsoft Defender for SQL	Same

Docs:

Azure SQL Database auditing: https://learn.microsoft.com/azure/azure-sql/database/auditing-overview
Managed Instance auditing: https://learn.microsoft.com/azure/azure-sql/managed-instance/auditing-configure
Ledger: https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-overview

Migration gotchas

Nothing converts your audit policies for you. SSMA and Azure DMS move schema and data only. Rebuild each unified policy by hand as action groups or audit specifications.
FGA column and handler logic doesn't port cleanly. Usually you combine an audit predicate with triggers or Defender alerts, or you accept coarser auditing.
Retention and immutability are set on the storage account, not in the database. Use immutable blob storage or Log Analytics retention in place of Oracle's DBMS_AUDIT_MGMT purge jobs.
Test the volume first. BATCH_COMPLETED_GROUP generates a lot of records and adds cost.

I've written this from my own knowledge and haven't rechecked the docs today. Confirm the exact 26ai desupport notes against the current 26ai release notes before you sign off.

Keyword search

BM25 over the same 446 documents: top 8 passages pasted in, one pass, references not followed.

larger model · 1 turn · 12 s · 19.1k in / 1.1k out

✓ verdict ✓ grounded ✗ cited

Grader: Correct verdict, flags passage limits; no URLs cited

8 keyword-search passages

feature_before-row-triggers score 14.7
feature_traditional-auditing score 13.384
mapping_before-row-triggers--azure-sql-db score 13.311
mapping_tls-1-0-1-1--azure-pg-flex score 11.401
mapping_database-links--azure-sql-db score 10.829
caveat_azure-sql-auditing-best-effort score 10.401
pattern_choose-migration-method score 10.393
mapping_tls-1-0-1-1--azure-sql-db score 10.069

Answer

Unified Auditing is the method that survives into 26ai. Traditional auditing is desupported there. On Azure SQL Database, the replacement is Azure SQL Auditing, which has some important limits.

Oracle side [2]

Traditional auditing is the pre-12c model. It covers:
- AUDIT/NOAUDIT statements and the AUDIT_TRAIL parameter
- records in SYS.AUD$ and FGA_LOG$, or in OS and XML files
- fine-grained audit policies managed through DBMS_FGA
Its status by release:
- 21c Upgrade Guide: deprecated (notice dated May 2021). Oracle recommends unified auditing instead.
- 26ai Upgrade Guide: desupported (notice dated April 2023). The same page also deprecates the PL/SQL cleanup helpers tied to the old audit trail. The passage is cut off after that, so I can't give the full list of what 26ai removes.
Unified Auditing arrived in 12.1. It replaced all of the above with policy objects and a single audit trail.
Migration impact: audit settings are usually required for compliance, so the target has to reproduce them. Before configuring Azure SQL Auditing, inventory:
- which statements, privileges and objects were audited
- the conditions set in fine-grained audit policies
- where the records were written
Databases running both traditional and unified auditing ("mixed mode") are harder to inventory.

Azure side

Azure SQL Auditing is the target named for Azure SQL [2]. For PostgreSQL, the equivalent is the pgAudit extension.
Limits that apply on General Purpose, Business Critical and Hyperscale (rated "major") [6]:
- It prioritises availability. During very high activity, transactions can go ahead without every audited event being recorded.
- The statement text is cut off at 4,000 characters.
- It doesn't audit tempdb or temporary tables.
- Failed Microsoft Entra logins aren't recorded in the SQL audit log.
Check these against your compliance requirements before you sign off. They matter most if you relied on complete capture, like Oracle's fine-grained auditing or full SQL text.
Audit columns stamped by BEFORE row triggers (a separate mechanism): SQL Server has no BEFORE triggers. Move that logic to DEFAULT constraints, set-based INSTEAD OF triggers, or application code [1][3].

What the passages don't cover: how to configure Azure SQL Auditing (targets, retention, action groups), or any direct mapping from DBMS_FGA policies to Azure SQL features. The passages also have no source URLs, so I can't cite links.

Sanity Context · GROQ

The agent with the GROQ endpoint: schema, joins, Portable Text.

smaller model · 10 turns · 57 s · 73.1k in / 4.3k out

✓ verdict ✓ grounded ✓ cited

Grader: Correct verdict; FLUSH removal claim unverifiable against passages

9 tool calls

initial_context on groq · 4,126 chars back

groq_query on groq · 784 chars back

*[_type=="oracleFeature" && (category=="security") && name match "*udit*"]{_id, name, slug, category, introducedIn, deprecatedIn, desupportedIn, oracleReplacement, reviewStatus}

groq_query on groq · 702 chars back

*[_type=="oracleFeature" && name match "*udit*"]{_id, name, slug, category, introducedIn, deprecatedIn, desupportedIn, oracleReplacement}

groq_query on groq · 1,532 chars back

*[_type=="oracleFeature" && category=="security"]{_id, name, slug, introducedIn, deprecatedIn, desupportedIn, oracleReplacement}

groq_query on groq · 4,595 chars back

*[_type=="mapping" && oracleFeature->slug.current=="traditional-auditing"]{_id, fidelity, effort, rationale, appliesToOracleVersions, "azureTarget": azureTarget->{name, service}, "sources": sources[]->{title,url}, "caveats": *[_type=="caveat" && references(^._id)]{severity, statement, appliesTo, firsthand, "evidence": evidence->{title,url,publisher}}}

groq_query on groq · 1,160 chars back

*[_type=="oracleFeature" && slug.current=="traditional-auditing"]{_id, name, "sources": sources[]->{title,url,publisher}}

array_field_reader on groq · 117 chars back

{
 "mode": "range",
 "documentId": "feature_traditional-auditing",
 "field": "obituary",
 "range": {
  "startIndex": 0,
  "endIndex": 20
 }
}

array_field_reader on groq · 1,921 chars back

{
 "mode": "range",
 "documentId": "feature_traditional-auditing",
 "field": "summary",
 "range": {
  "startIndex": 0,
  "endIndex": 20
 }
}

groq_query on groq · 547 chars back

*[_type=="dispute" && (claimA->mapping->_id=="mapping_traditional-auditing--azure-sql-auditing" || claimB->mapping->_id=="mapping_traditional-auditing--azure-sql-auditing")]{title, whatDisagrees, resolution, "claimA": claimA->{statement}, "claimB": claimB->{statement}}

Answer

No dispute found on this mapping. Here's the evidence-backed answer:

Verdict: Traditional (pre-Unified) Auditing does NOT survive into 26ai — it is deprecated in 21c and desupported in 26ai. What actually survives (and carries the audit workload forward) is Unified Auditing, introduced in 12.1, which Oracle designated as the replacement.

Oracle side

Traditional auditing (AUDIT/NOAUDIT statements, AUDIT_TRAIL parameter, SYS.AUD$/FGA_LOG$ tables, DBMS_FGA) was deprecated in 21c (notice dated May 2021) and desupported in 26ai (notice dated April 2023). The 26ai release also removes the FLUSH_UNIFIED_AUDIT_TRAIL procedure since unified audit records write directly to their table. — Oracle Database Changes, Desupports, and Deprecations (Upgrade Guide 26ai), Oracle Database Changes, Desupports, and Deprecations (Upgrade Guide 21c)
Unified auditing (policy objects, single audit trail) replaced it starting in 12.1. — same source set above; also Topics for Database Administrators and Developers (Database Concepts 19c)
Note: the dataset has no separate oracleFeature/mapping entry dedicated to Unified Auditing itself — this description comes from the summary text attached to the traditional-auditing feature record.

Azure SQL side (Oracle Database, editions 11.2–23ai per the mapping's scoped versions, mapped from the traditional-auditing model)

Target: Azure SQL Auditing (Azure SQL Database, General Purpose/Business Critical/Hyperscale tiers). Fidelity is partial, effort M. Oracle AUDIT statements on objects/privileges/sessions map to Azure SQL audit action groups (logins, batch completed, schema/permission changes) written to Blob Storage, Log Analytics, or Event Hubs. — Auditing for Azure SQL Database and Azure Synapse Analytics, Configure auditing for Azure SQL Managed Instance
Caveat (major severity, tiers: General Purpose/Business Critical/Hyperscale): Azure SQL auditing is optimized for availability — it may allow transactions to proceed without recording every audited event under very high load, truncates the statement field at 4,000 characters, does not audit tempdb/temp tables, and does not log failed Microsoft Entra logins. — Auditing for Azure SQL Database and Azure Synapse Analytics (Microsoft)

Related alternative in the dataset: for Azure Database for PostgreSQL Flexible Server, the same traditional-auditing feature maps to the pgAudit extension (partial fidelity, effort M), with its own caveats — config lost on major-version upgrade, and superusers not reliably auditable/best-effort logging. — Audit logging in Azure Database for PostgreSQL flexible server (pgaudit) (Microsoft), pgAudit README (community)

Gap: No dispute record exists in the dataset for this mapping, and the mapping's appliesToOracleVersions list stops at 23ai (does not include 26ai) — consistent with desupport of the traditional model at that release.

GROQ + Knowledge Base

The agent with both endpoints.

smaller model · 10 turns · 49 s · 131.9k in / 4.0k out

✓ verdict ✓ grounded ✓ cited

Grader: Correct 21c/26ai lifecycle, Azure SQL Auditing, caveats cited

9 tool calls

initial_context on groq · 4,126 chars back
initial_context on kb · 7,679 chars back

knowledge_base_read on kb · 8,160 chars back

{
 "knowledgeBase": "kb6MdvV3ZA3Q",
 "paths": [
  "feature_migration/auditing",
  "oracle_concepts/terminology"
 ]
}

groq_query on groq · 719 chars back

*[_type=="oracleFeature" && category=="security" && (name match "*udit*")]{_id, name, "slug": slug.current, introducedIn, deprecatedIn, desupportedIn, oracleReplacement, reviewStatus}

groq_query on groq · 5,789 chars back

*[_type=="oracleFeature" && slug.current in ["unified-auditing","traditional-auditing"]]{
  _id, name, "slug": slug.current, introducedIn, deprecatedIn, desupportedIn, oracleReplacement,
  "sources": sources[]->{title, url},
  "mappings": *[_type=="mapping" && references(^._id)]{
    fidelity, effort, rationale, appliesToOracleVersions,
    "azureTarget": azureTarget->{name, "slug": slug.current},
    "sources": sources[]->{title, url},
    "caveats": *[_type=="caveat" && references(^._id)]{
      severity, statement, appliesTo, firsthand,
      "evidence": evidence->{title, url}
    }
  }
}

groq_query on groq · 736 chars back

{
  "unifiedFeature": *[_type=="oracleFeature" && name match "*nified*udit*"]{name, "slug": slug.current, introducedIn, deprecatedIn, desupportedIn},
  "glossaryEntry": *[_type=="glossary" && term match "*nified*udit*"][0]{term, definition, alsoKnownAs, "sources": sources[]->{title,url}}
}

groq_query on groq · 381 chars back

*[_type=="glossary"]{term, "slug": _id}[_id match "*audit*" || term match "*udit*"]

groq_query on groq · 1,874 chars back

*[_type=="glossary" && _id=="glossary_unified-auditing"][0]{term, definition, alsoKnownAs, "sources": sources[]->{title, url}}

groq_query on groq · 314 chars back

*[_type=="source" && title match "*Unified Auditing to Azure*"][0]{title, url, publisher}

Answer

Verdict: Oracle Unified Auditing (12c+) is the method that survives into 26ai. Traditional Auditing is deprecated in 21c and desupported in 26ai, replaced by Unified Auditing. Azure SQL Database/Managed Instance's counterpart is Azure SQL Auditing, mapped at partial fidelity with documented coverage gaps.

Oracle side

Traditional (pre-Unified) Auditing (AUDIT_TRAIL parameter, SYS.AUD$, FGA_LOG$) — introduced pre-11.2, deprecated in 21c, desupported in 26ai; Oracle's recorded replacement is Unified Auditing. Oracle Database Changes, Desupports, and Deprecations (Upgrade Guide 21c), Oracle Database Changes, Desupports, and Deprecations (Upgrade Guide 26ai)
Unified Auditing (12c onward) — Oracle's single audit facility: named policies (CREATE AUDIT POLICY / AUDIT), all sources written to UNIFIED_AUDIT_TRAIL, managed via DBMS_AUDIT_MGMT; predefined ORA_SECURECONFIG and ORA_LOGON_FAILURES ship enabled; records are written in queued mode (call DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL before trusting an empty-looking trail). It explicitly replaces the now-desupported traditional auditing. Oracle Database Security Guide 19c: Introduction to Auditing

Azure side — mapping (dataset: traditional-auditing → Azure SQL Auditing)

Fidelity: partial, effort M, applies to Oracle 11.2–23ai source states (i.e., while traditional auditing still exists on the source). Azure SQL AUDIT action groups (batch completed, logins, schema/permission changes) written to Blob Storage, Log Analytics, or Event Hubs are the mapped mechanism; granularity differs from Oracle's per-object BY ACCESS/BY SESSION model. Auditing for Azure SQL Database and Azure Synapse Analytics, Configure auditing for Azure SQL Managed Instance
Caveat (major severity), applies to Azure SQL tiers General Purpose, Business Critical, Hyperscale: Azure SQL Auditing is best-effort under very high load (may not capture every event), truncates statement text at 4,000 characters, does not audit tempdb/temp tables, and does not record failed Microsoft Entra logins in the SQL audit log (those require Entra sign-in logs separately). Auditing for Azure SQL Database and Azure Synapse Analytics

Other Azure targets (context, not Azure SQL):

PostgreSQL Flexible Server maps traditional-auditing intent to pgAudit, also partial fidelity, with caveats that pgAudit config is lost on in-place major-version upgrades and that superusers can't be reliably audited. Audit logging in Azure Database for PostgreSQL flexible server (pgaudit), pgAudit README
Oracle Database@Azure requires no re-expression: Unified Auditing runs unchanged in-database, optionally surfaced via Azure Monitor — per the "Auditing Migration and Compliance" pattern entry.

No dispute in the dataset touches this topic.

← q07 All cases q09 →