Abstract: Techniques for aggregating and emitting database activity record batches are described. Database activity records can be written to a shared memory queue and emitted to a destination using a remote procedure call (RPC). Individual database connection server processes can write client activity records to the queue. An activity monitor plugin in the database engine can monitor the audit records and aggregate the audit records into batches. Batches of audit records can be sent via RPC to their final or intermediate destination. Each instance host in a database service can include a client backend process configured to define how to submit audit records to shared memory. The activity monitor plugin can batch audit records in to messages and submit those messages via RPC to a security host manager and relaying response back to each relevant client backend.