I open oracle database in read only mode just for testing spillover files and in addition I created simple unified audit policy on action select table, the problem is that spillover files not generated when I select table. ( in read write mode this policy works )
General info
unified audit enabled
unified audit policy enabled
SELECT * FROM AUDIT_UNIFIED_ENABLED_POLICIES WHERE POLICY_NAME = 'TEST';
USER_NAME|POLICY_NAME|ENABLED_OPT|SUCCESS|FAILURE|
---------+-----------+-----------+-------+-------+
ALL USERS|TEST |BY |YES |YES |
SELECT POLICY_NAME, AUDIT_OPTION, AUDIT_OPTION_TYPE, OBJECT_SCHEMA, OBJECT_NAME, OBJECT_TYPE, AUDIT_UNIFIED_POLICIES WHERE POLICY_NAME = 'TEST';
POLICY_NAME|AUDIT_OPTION|AUDIT_OPTION_TYPE|OBJECT_SCHEMA|OBJECT_NAME|OBJECT_TYPE|
-----------+------------+-----------------+-------------+-----------+-----------+
TEST |SELECT |OBJECT ACTION |KAMRAN |T1 |TABLE |
SQL> SELECT OPEN_MODE FROM V$DATABASE;
OPEN_MODE
--------------------
READ ONLY
SQL> show parameter audit
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /u01/app/oracle/admin/ORCL/adu
mp
audit_sys_operations boolean TRUE
audit_syslog_level string
audit_trail string OS
unified_audit_sga_queue_size integer 1048576
SQL>
Generation of spillover files.
Even though you have set 'audit_file_dest', if the database is read-only then you'll find the unified audit records in $ORACLE_BASE/audit/$ORACLE_SID