What are spill over files when working with Unified Auditing and when are they generated?

Spill over files are files that are stored on the OS when the database is not able to write them to the database. There are (as far as I came across) two main reason why this happens:

• Your database is not writable
• The audit data is written by an OS process (PMON)

Both cases seem pretty straight forward. When your database is not writable, you cant write data to the audit table. As a consequence the auditing that is generated will be sent to spill over files on the OS. These files (.bin) can be found in:

$ORACLE_BASE/audit/$ORACLE_SID

The second reason. When a connection closes abruptly, PMON will notice this. PMON, being an OS proces, cannot write to the audit trail in the database. PMON will write the action to spill over files on the OS. The ACTION_NAME of these records in the audit trail will be:

LOGOFF BY CLEANUP

Conclusion

Audit data gets written to the database in most cases. We saw two cases in which this does not happen. Spill over files prevent that this auditing goes missing.