Auditing database access is a much bigger topic than you might expect because it can cover a whole range of requirements.
First, decide which of these you want and look at the appropriate subsection:
- What were the SQL statements executed? Auditing SQL
- What were the tables accessed? Auditing table access
- What were the data rows changed? Auditing data changes
- What were the data rows viewed? Not described here, usually too much data
Auditing just SQL produces the lowest volume of audit log information, especially if you choose to log only DDL. Higher levels accumulate more information very rapidly, so you may quickly decide not to do this in practice. Read each section to understand the benefits and trade-offs.