Until 11.2, audit_file_dest used to remain small with default settings and reasonably sized and active database. Suddenly, in 12c, you will sooned or later get ORA-09925: Unable to create audit trail file.
At that point, no more connection is possible to the database, it is a complete loss of service.
Why suddenly in 12c ? This is because the default for audit_sys_operations changed to true. In 11g, you used to get an 1K file each time you connect as sysdba. So a few tousands sysdba connections a weeks, a few mega, no worries.
Mon Mar 27 14:08:01 2017 +02:00
LENGTH : '155'
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : 'SYSDBA'
CLIENT USER: 'oracle'
CLIENT TERMINAL: ''
Suddenly in 12c, you get plenty files that are many Mb. For instance for AUTOTASK jobs, every single select is dumped to the filesystem. A single week-end of an quiet database may generate 1Gb of *.aud files of DBMS_SCHEDULER.
Those DB001_j000_12345_20170327140802123456789.aud files are highly useless and annoying.
LENGTH : '641'
ACTION : 'select /*+ no_parallel(t) no_parallel_index(t) dbms_stats cursor_sharing_exact use_weak_name_resl dynamic_sampling(0) no_monitoring xmlindex_sel_idx_tbl no_substrb_pad */ substrb(dump("PERIOD_END_TIME",16,0
rowidtochar(rowid) rwid from "SYS"."WRP$_REPORTS_TIME_BANDS" t where rowid in (chartorowid('AABJ58AADAAAMsrAAA'),chartorowid('AABJ58AADAAAMsrAAB'),chartorowid('AABJ58AADAAAMsrAAC'),chartorowid('AABJ58A
ADAAAMssAAA')) order by "PERIOD_END_TIME"'
DATABASE USER: 'SYS'
PRIVILEGE : 'NONE'
CLIENT USER: ''
CLIENT TERMINAL: 'UNKNOWN'
Once your audit_file_dest is getting full, your database stops, so better delete those *_j00*_* and *_m00*_* quickly enough!