Generate Audit Reports
You generate an audit report from an audit definition — a reusable configuration for what to report and when.
Audit Definitions and Report Instances
Section titled “Audit Definitions and Report Instances”An audit definition is the reusable configuration behind every report: the data sources in scope, the event filters, the coverage window, and the number of required approvals. You can run a definition at any time or set it to run on a schedule.
Each run produces a report instance. Instances are independent — each carries its own generation status, data, review state, and approvals, so re-running a definition never overwrites an earlier report.
Audit Schedule Filters
Section titled “Audit Schedule Filters”Filters narrow a definition to specific activity using an include/exclude model. Each filter row selects a category — such as database user or statement type — an operator (is, is not, contains, does not contain), and one or more values. Multiple rows combine with AND logic; multiple values within a single row combine with OR logic.
Report Coverage
Section titled “Report Coverage”Report coverage is the lookback window applied when a report runs, chosen from a fixed set of options measured in full calendar days backward from the run date.
Scheduled Definitions
Section titled “Scheduled Definitions”A scheduled definition runs automatically at its configured cadence. ALTR advances the schedule on each run and displays the upcoming runs alongside an aggregate review status across recent instances. The schedule details panel shows whether the last scheduled run succeeded or failed and when it ran, which helps diagnose a missed or failed report.
Report Outputs
Section titled “Report Outputs”Each report instance produces two files.
- PDF — a formatted, printable report in a landscape table layout, capped at 10,000 rows. A preliminary log-only PDF is available at run time; see Attestation Output for the final attestation PDF.
- CSV — a full export of the underlying audit event data with no row cap. Use CSV as the source of truth for high-volume reports that exceed the PDF row cap.
Both files are available as downloads from the report instance view.
Report Content
Section titled “Report Content”A report contains the Database Activity Monitoring records from the selected data sources that fall within the coverage window and match the filters. The report’s content and output format are fixed — the fields shown in the summary panel and the event detail table are not configurable. The Data Filters step controls which records a report includes, not what’s shown for each included record.
A summary panel aggregates the report:
| Metric | Description |
|---|---|
| Total Events | Count of all captured activity events in the coverage window |
| Unique Databases | Number of distinct databases with activity |
| Unique Statement Types | Number of distinct statement type categories |
| Unique Users | Number of distinct database users with activity |
The event detail table lists one row per captured event, with these fields:
| Field | Description |
|---|---|
| Event ID | Unique identifier for the audit event |
| Event Date & Time | Timestamp of the statement |
| Event Name | Event classification, such as STATEMENT_EXECUTED |
| Event Source | The ALTR component that captured the event, such as oracle-sidecar |
| Event Type | Audit event type category, such as sidecar-audit |
| Event Version | Schema version of the event record |
| Client ID | ALTR tenant identifier |
| User | Database user that executed the statement |
| Source Application | Application that originated the connection |
| Source IP | IP address or hostname of the connecting client |
| Statement Type | SQL statement category (SELECT, INSERT, UPDATE, DELETE, DDL, DCL) |
| Parsed Query | Query text with sensitive literals redacted |
| Database | Database name |
| Repository | ALTR repository the database belongs to |
| Row Count | Number of rows returned or affected |
Query text in the Parsed Query field has its sensitive literals redacted the same way as in the Query Log; exact query parameters are not preserved in the report.
Generate a Report on Demand
Section titled “Generate a Report on Demand”To generate an audit report on demand:
- Select Audit Reports in the navigation menu.
- Locate an existing audit definition, or create one.
- Select Run Now from the definition’s menu.
- Wait for the report instance to appear in the definition’s instance list. Its status changes from in-progress to Needs review — or Approved, if the definition requires zero approvals — when generation completes.
- Download the PDF or CSV from the instance view.
Create an Audit Schedule
Section titled “Create an Audit Schedule”In the UI, an audit definition is called an audit schedule — and despite that name, you can run one on demand at any time with Run Now.
To create an audit schedule, complete the six-step wizard:
- Name & Description — Enter a name for the audit schedule and, optionally, a description.
- Repositories — Select the OLTP repositories to include in the report scope.
- Data Filters — Configure include/exclude filters. Each row picks a category, an operator, and one or more values.
- Schedule — Set the start date, the recurrence cadence, and the coverage window.
- Approvals — Set the number of approvals required per report instance. Zero is allowed.
- Notifications — Enter the email addresses that receive a notification when a report generates and when its final attestation PDF is ready.
To finish, click Create. ALTR displays “Report definition created successfully.” and closes the drawer, returning you to the Audit Reports list.