ALTER DATABASE AUDIT SPECIFICATION

Hi, 
I've created a database audit in SQL2008R2 and now can't seem to disable/delete it.  I assumed it would be a case of
disable database audit 
delete database audit
disable server audit 
delete server audit
However I cannot even do steps 1 and 2. I scripted deletion of the database audit but when I run it from a query window it just runs and runs.  
USE [Admin]
GO
ALTER DATABASE AUDIT SPECIFICATION [DatabaseAuditSpecification-20150420-122643]
WITH (STATE = OFF)
GO
USE [Admin]
GO
DROP DATABASE AUDIT SPECIFICATION [DatabaseAuditSpecification-20150420-122643]
GO
Now I can't even open/refresh the "Audits" folder at the instance level, getting this error
"Lock request time out period exceeded. (Microsoft SQL Server, Error: 1222)" 
I have the option of restarting the instance tonight at 18:30, however I need to be able to audit
a couple of databases for DELETE/INSERT before this time. 
Any ideas? 
Thanks in advance. 

I suspect that you may need to have exclusive access to the database for a short period of time in order to disable the Database
Audit Specification.
Perhaps try switching the database to RESTRICTED_USER in order to perform the audit deletion/disable and then
reverting back to MULTI_USER
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/0ef500d6-b902-4c64-88d3-e2871eb98ac8/trouble-while-enabling-database-audit-specification

Similar Messages

  • "Database Audit Specification" not available.

    Hi all, 
    Been asked by one of the developers to audit delete & insert for one night only so I thought to investigate built in auditing via "new
    Database Audit Specification".  I am in the sysadmin role but no  option to add a database audit, the server audit is however available.
    This is SQL 2008R2 enterprise. 
    Any ideas? 
    Thanks

     I am in the sysadmin role but no  option to add a database audit, the server audit is however available.
    This is SQL 2008R2 enterprise. 
    Any ideas? 
    Thanks
    It is something that should be created at Database level so you need to navigate to Database - Security folder.
    There "New DB Audit Sepcification" option can be seen.
    E.g.
    Cheers,
    Vaibhav Chaudhari
    [MCP],
    [MCTS], [MCSA-SQL2012]

  • DATABASE AUDIT SPECIFICATION ON SPECIFIC USERS

    Hi All,
    Currently I am using SQL server 2012 and would like to implement database audit specification on specific users in my database. These are the users in my database name Payroll :-
    Payroll\Andy.Bred - db_owner
    Payroll\Arpit.Shah - db_owner
    Payroll\webapp - db_datareader, db_datawriter, EXECUTE
    web_payroll - db_datareader, db_datawriter, EXECUTE
    In my database audit specification settings, I would like to capture any SELECT,UPDATE,DELETE and EXECUTE command for users Payroll\Andy.Bred & Payroll\Arpit.Shah only since they owned db_owner access. However, I am unable to capture any single command
    from both users. I do not want to put 'Principal' as public since I just want to capture both users activity.
    Is it I miss out anything? Is it because of windows login account? Hope can get some advise here. Highly appreciated.
    Thanks.
    Best Regards,
                     Han

    Hi   Han,
    Are your Windows login accounts member of the SQL Server sysadmin role? If that is the case, the login accounts are indirectly mapped as database user dbo. Please change the principal name in the audit action name to dbo and check if the users activity is
    being audited.
    There are also similar threads for your reference.
    http://www.sqlservercentral.com/Forums/Topic1082578-1526-1.aspx
    https://social.msdn.microsoft.com/Forums/sqlserver/en-US/a1df289d-555e-46c3-803a-2ae97af807a3/sql-auditing-database-audit-specification-is-not-logging-events-by-windows-authenticated-user?forum=sqlsecurity
    Thanks,
    Lydia Zhang
    Lydia Zhang
    TechNet Community Support

  • Can we have multiple database audit specification on a single server audit ?

    Hi,
    We are having a 2 node Sql Clustered instance of SqlServer 2008 R2 Enterprise running
    on windows server 2008 R2. We have about 88 databases in the instance.
    Our servers run on Intel Xeon(R) CPU X5670 @2.94 GHz with 6 cores(12 logical processor).
    The servers are having 12GB of RAM.
    We are planning to introduce database level audit to find if there is any activity on
    some of our databases. These databases are not growing in size and there is a request
    from the application team to ascertain whether the endusers are accessing the database
    over a period of time. In this context I have 2 queries-:
    1)Can we have multiple database audit specification on a single server audit ie can we
    audit multiple databases to find out the user activity on those databases at a time? Or
    should we a separate server audit for each database audit specification?
    2)We plan to have the target of the audit on a file on the same shared volume(lun) where
    the MDF file and LDF files are located(in EMC storage) and in this context what performance
    monitor counters should we watch to ascertain whether there is any performance degradation
    due to introduction of server audit.
    Thanking you in advance
    Binny Mathew.

    As Auditn  is at the SQL Server instance level. You can have multiple audits per SQL Server instance.
    http://msdn.microsoft.com/en-us/library/cc280386.aspx
    Database Audit Specification
    The Database Audit Specification object also belongs to a SQL Server audit. You can create one database audit specification per SQL Server database per audit.
    The database audit specification collects database-level audit actions raised by the Extended Events feature. You can add either audit action groups or audit events to a database audit specification. Audit events are
    the atomic actions that can be audited by the SQL Server engine. Audit action groups are predefined groups of actions. Both are at the SQL Server database scope. These actions are sent to the audit, which records
    them in the target. Do not include server-scoped objects, such as the system views, in a user database audit specification.
    Database-level audit action groups and audit actions are described in the topic SQL Server Audit Action Groups and Actions.
    You can also consider using a Profiler trace file to capture the events.
    Best Regards,Uri Dimant SQL Server MVP,
    http://sqlblog.com/blogs/uri_dimant/
    MS SQL optimization: MS SQL Development and Optimization
    MS SQL Consulting:
    Large scale of database and data cleansing
    Remote DBA Services:
    Improves MS SQL Database Performance
    SQL Server Integration Services:
    Business Intelligence

  • How to find the database details from server audit specification with successfull login group?

    Hi,
    We have created a server audit for successfull logins.When we read the audit file using
    sys.fn_get_audit_file we find that all the fields related to the databases
    ie database_principal_id,database_principal_name,database_name are either 0 or null.
    Is there a method to find out to which database the login is accessing from the server
    audit specification of successfull login group.Although the logins are reading and writing
    data to the databases why there are no details of the databases?
    Thanking you in advance,
    Binny Mathew

    Hello Binny,
    The logins are used to connect to the instance and the access to the databases is performed via database users. So, once you connect to the instance via your login, the server level audit takes this action, records it, but without caring to which databases
    you want to connect after that. 
    Unfortunately there is no similar action group on the database audit specifications, that can track which user connected to the DB, except if you are using contained databases in SQL 2012.
    Probably you can share why you need such information and if there is something else specific that you wish to achieve, so we can propose a different solution/audit configuration.
    Regards,
    Ivan
    Ivan Donev MCT and MCSE Data Platform

  • How to find SQL statement = Database Auditing

    Dear All
    I have configured Database Auditing on Oracle 9i Enterprise Edition Server
    parameter init.ora file:
    AUDIT_TRAIL = "DB"
    I want to audit INSERT,UPDATE, DELETE STATEMENT on PRACTICE.EMP table
    for which i did :
    1) Logged in as SYS
    SQL> AUDIT INSERT,UPDATE,DELETE
    ON PRACTICE.EMP
    BY ACCESS
    WHENEVER SUCCESSFUL
    Audit Succedded
    2) Now I have to check the SQL statement that did insert update or delete operation using SYS.AUD$
    3) There is SQLTEXT field , datatype is CLOB.
    How should I check the SQL Statements that were fired on PRACTICE.EMP table
    Kindly help

    SQL> show user
    USER is "SYS"
    SQL> alter system set audit_trail = db,extended scope=spfile;
    alter system set audit_trail = db,extended scope=spfile
    ERROR at line 1:
    ORA-32001: write to SPFILE requested but no SPFILE specified at startup
    I have init.ora but no spifle so should I create SPFILE based on INIT.ORA and then give the command ?
    As of now I am using V$SQL view to find all the commands executed on my database.
    I found one good book "Oracle Security" OREILY PUBLICATION in which Auditing Database is discussed in good details.
    Thank you so much for all your efforts

  • What if "ALTER DATABASE OPEN" WORKS WHEN DB IS INCONSISTENT???

    Hello Everyone,
    I heard from couple of friends that in the case of recovery , oracle database opens despite the fact that some of the data files are inconsistent.
    Is this really true? If it is, then i think its a bug with specific Oracle patch or release.
    Is there anyone who has experienced a similar situation in the past? Please share.
    Thanks.
    sapguy

    Appreciate your response. I ran into a situation where we are not sure of what time choose to choose recovery (point in time) and ended up recovering file by file and its been 100 files .. .none of those files helped with "Media recovery complete" message . This is database refresh from production backup.
    Then when i am trying to issue ALTER DATABASE OPEN RESETLOGS  one of main guy says do not issue OPEN command as it may corrupt the database.
    I came across one of friend who ran into similar situation and he was able open the database , but LATER database started issuing ora 600 due to corrupted files or whatever which never happened.   Forgive me .. if my text is confusing.
    Thanks.

  • Alter database open

    Hi,
    I try to start a database with the commands
    startup mount
    alter database noarchivelog
    everything is ok up to now
    When I give the command
    alter database open
    I obtain
    ERROR at line 1
    ORA-01092 Oracle instance terminated Disconnection forced.
    Why?
    Thank you,
    Mihaela

    I post the last 120 lines of alert_log:
    Mon Jul 24 12:57:31 2006
    alter database noarchivelog
    Mon Jul 24 12:57:31 2006
    Completed: alter database noarchivelog
    Mon Jul 24 12:57:44 2006
    alter database open
    Mon Jul 24 12:57:47 2006
    Thread 1 opened at log sequence 1281
    Current log# 3 seq# 1281 mem# 0: /web/oradata/simmer/redo03_A.log
    Current log# 3 seq# 1281 mem# 1: /web/oradata/simmer/redo03_B.log
    Successful open of redo thread 1
    Mon Jul 24 12:57:47 2006
    SMON: enabling cache recovery
    Mon Jul 24 12:57:50 2006
    Successfully onlined Undo Tablespace 1.
    Mon Jul 24 12:57:50 2006
    SMON: enabling tx recovery
    Mon Jul 24 12:57:50 2006
    Errors in file /web/bin/oracle/9206/admin/simmer/udump/simmer_ora_1636.trc:
    ORA-12701: CREATE DATABASE character set is not known
    Mon Jul 24 12:57:50 2006
    Error 12701 happened during db open, shutting down database
    USER: terminating instance due to error 12701
    Instance terminated by USER, pid = 1636
    ORA-1092 signalled during: alter database open
    Tue Jul 25 09:52:36 2006
    Starting ORACLE instance (normal)
    LICENSE_MAX_SESSION = 0
    LICENSE_SESSIONS_WARNING = 0
    SCN scheme 3
    Using log_archive_dest parameter default value
    LICENSE_MAX_USERS = 0
    SYS auditing is disabled
    Starting up ORACLE RDBMS Version: 9.2.0.6.0.
    System parameters with non-default values:
    processes = 300
    timed_statistics = TRUE
    shared_pool_size = 117440512
    large_pool_size = 16777216
    java_pool_size = 117440512
    control_files = /web/oradata/simmer/control01.ctl, /web/arhive/ctl/control02.ctl, /web/bin/oracle/9206/ctl/control03.ctl
    db_block_size = 8192
    db_cache_size = 33554432
    compatible = 9.2.0.0.0
    db_file_multiblock_read_count= 16
    fast_start_mttr_target = 300
    undo_management = AUTO
    undo_tablespace = UNDOTBS1
    undo_retention = 10800
    remote_login_passwordfile= EXCLUSIVE
    db_domain =
    instance_name = SIMMER
    job_queue_processes = 10
    hash_join_enabled = TRUE
    background_dump_dest = /web/bin/oracle/9206/admin/simmer/bdump
    user_dump_dest = /web/bin/oracle/9206/admin/simmer/udump
    core_dump_dest = /web/bin/oracle/9206/admin/simmer/cdump
    sort_area_size = 1048576
    db_name = SIMMER
    open_cursors = 300
    optimizer_mode = rule
    star_transformation_enabled= FALSE
    query_rewrite_enabled = FALSE
    pga_aggregate_target = 25165824
    aq_tm_processes = 1
    PMON started with pid=2
    DBW0 started with pid=3
    LGWR started with pid=4
    CKPT started with pid=5
    SMON started with pid=6
    RECO started with pid=7
    CJQ0 started with pid=8
    QMN0 started with pid=9
    Tue Jul 25 09:52:44 2006
    ALTER DATABASE MOUNT
    Tue Jul 25 09:52:49 2006
    Successful mount of redo thread 1, with mount id 535276268
    Tue Jul 25 09:52:49 2006
    Database mounted in Exclusive Mode.
    Completed: ALTER DATABASE MOUNT
    Tue Jul 25 09:52:50 2006
    ALTER DATABASE OPEN
    Tue Jul 25 09:52:51 2006
    Beginning crash recovery of 1 threads
    Tue Jul 25 09:52:52 2006
    Started redo scan
    Tue Jul 25 09:52:53 2006
    Completed redo scan
    21 redo blocks read, 5 data blocks need recovery
    Tue Jul 25 09:52:53 2006
    Started recovery at
    Thread 1: logseq 1281, block 1240, scn 0.28883578
    Tue Jul 25 09:52:53 2006
    Recovery of Online Redo Log: Thread 1 Group 3 Seq 1281 Reading mem 0
    Mem# 0 errs 0: /web/oradata/simmer/redo03_A.log
    Mem# 1 errs 0: /web/oradata/simmer/redo03_B.log
    Tue Jul 25 09:52:53 2006
    Completed redo application
    Tue Jul 25 09:52:53 2006
    Ended recovery at
    Thread 1: logseq 1281, block 1261, scn 0.28903619
    5 data blocks read, 5 data blocks written, 21 redo blocks read
    Crash recovery completed successfully
    Tue Jul 25 09:52:54 2006
    Thread 1 advanced to log sequence 1282
    Thread 1 opened at log sequence 1282
    Current log# 1 seq# 1282 mem# 0: /web/oradata/simmer/redo01_A.log
    Current log# 1 seq# 1282 mem# 1: /web/oradata/simmer/redo01_B.log
    Successful open of redo thread 1
    Tue Jul 25 09:52:56 2006
    SMON: enabling cache recovery
    Tue Jul 25 09:52:59 2006
    Successfully onlined Undo Tablespace 1.
    Tue Jul 25 09:52:59 2006
    SMON: enabling tx recovery
    Tue Jul 25 09:52:59 2006
    Database Characterset is US7ASCII
    replication_dependency_tracking turned off (no async multimaster replication found)
    Completed: ALTER DATABASE OPEN
    openes.hq.fdeb.ro>
    Thank you,
    Mihaela

  • Alter Database Open Mystery

    We have a script that issued the Startup command this morning. In the .trc logs we are able to see that the Startup command got as far as the Alter Database Mount command. So we know this command completed successfully. But the next command we expect to see is the Alter Database Open command. This was mysteriously absent from the .trc file.
    We lack a full time DBA on our project so we are wondering if there is a logical explanation for this failure? Are there any places we can look to see why the Alter Database Open command was never issued and didn't appear in the .trc log?
    Any suggestions or probably causes would be greatly appreciated.

    DB version 9.2.0.6.0 on Solaris 8
    Just noticed that our /UNDO file system is a 99% and that our UNDO tablespace is using 'auto extend' option. Could this be a potential cause?
    /dev/vx/dsk/rootdg/undo
    11796416 10490922 125853 99% /undo
    The alert log just stopped and didn't show anything regarding the Alter Database Open command. Then it jumps to this morning when one of our guys started the database manually. You can see this where May 3rd entries stop:
    ALTER DATABASE MOUNT
    Thu May 3 23:18:24 2007
    Successful mount of redo thread 1, with mount id 1534972155
    Thu May 3 23:18:24 2007
    Database mounted in Exclusive Mode.
    Completed: ALTER DATABASE MOUNT
    Fri May 4 07:10:07 2007
    Starting ORACLE instance (normal)
    Fri May 4 07:12:57 2007
    Shutting down instance: further logons disabled
    Shutting down instance (immediate)
    License high water mark = 3
    Fri May 4 07:12:57 2007
    ALTER DATABASE CLOSE NORMAL
    ORA-1109 signalled during: ALTER DATABASE CLOSE NORMAL...
    Fri May 4 07:12:57 2007
    ALTER DATABASE DISMOUNT
    Completed: ALTER DATABASE DISMOUNT
    ARCH: Archiving is disabled
    Shutting down archive processes
    Archiving is disabled
    Archive process shutdown avoided: 0 active
    ARCH: Archiving is disabled
    Shutting down archive processes
    Archiving is disabled
    Archive process shutdown avoided: 0 active
    Fri May 4 07:13:07 2007
    Starting ORACLE instance (normal)
    Disable cache advisory with old cache parameters
    LICENSE_MAX_SESSION = 0
    LICENSE_SESSIONS_WARNING = 0
    SCN scheme 3
    Using log_archive_dest parameter default value
    LICENSE_MAX_USERS = 0
    SYS auditing is disabled
    Starting up ORACLE RDBMS Version: 9.2.0.6.0.
    System parameters with non-default values:
    processes = 200
    timed_statistics = TRUE
    shared_pool_size = 150994944
    java_pool_size = 50331648
    nls_date_format = DD-MON-RR
    control_files = /oracle_data/oradata1/FC/control01.ctl, /oracle_dat
    a/oradata2/FC/control02.ctl, /oracle_data/oradata3/FC/control03.ctl
    db_block_buffers = 22000
    db_block_size = 2048
    db_writer_processes = 2
    dbhandles_cached = 0
    compatible = 9.0.0.0.0
    log_buffer = 524288
    log_checkpoint_interval = 10000
    db_files = 38
    db_file_multiblock_read_count= 32
    dml_locks = 1500
    undo_management = AUTO
    undo_tablespace = undotbs_01
    max_enabled_roles = 100
    remote_login_passwordfile= EXCLUSIVE
    db_domain = .WORLD
    service_names = FC
    utl_file_dir = /apps/oracle9i/admin/FC/script
    job_queue_processes = 1
    systemtrig_enabled = TRUE
    background_dump_dest = /apps/oracle9i/admin/FC/bdump
    user_dump_dest = /apps/oracle9i/admin/FC/udump
    max_dump_file_size = 10240
    core_dump_dest = /apps/oracle9i/admin/FC/cdump
    audit_trail = DB
    sort_area_size = 1500000
    db_name = FC
    open_cursors = 200
    optimizer_mode = choose
    PMON started with pid=2
    DBW0 started with pid=3
    DBW1 started with pid=4
    LGWR started with pid=5
    CKPT started with pid=6
    SMON started with pid=7
    RECO started with pid=8
    CJQ0 started with pid=9
    Fri May 4 07:13:09 2007
    ALTER DATABASE MOUNT
    Fri May 4 07:13:14 2007
    Successful mount of redo thread 1, with mount id 1534971461
    Fri May 4 07:13:14 2007
    Database mounted in Exclusive Mode.
    Completed: ALTER DATABASE MOUNT
    Fri May 4 07:13:14 2007
    ALTER DATABASE OPEN
    Fri May 4 07:13:15 2007
    Thread 1 opened at log sequence 272984
    Current log# 4 seq# 272984 mem# 0: /rollback_logs/FC/redo04.log
    Successful open of redo thread 1
    Fri May 4 07:13:15 2007
    MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
    Fri May 4 07:13:15 2007
    SMON: enabling cache recovery
    Fri May 4 07:13:17 2007
    Successfully onlined Undo Tablespace 17.
    Fri May 4 07:13:17 2007
    SMON: enabling tx recovery
    Fri May 4 07:13:17 2007
    Database Characterset is US7ASCII
    replication_dependency_tracking turned off (no async multimaster replication fou
    nd)
    Completed: ALTER DATABASE OPEN
    Fri May 4 07:15:05 2007
    Thread 1 advanced to log sequence 272985
    Current log# 5 seq# 272985 mem# 0: /rollback_logs/FC/redoFC05.log
    Fri May 4 07:15:28 2007
    Thread 1 advanced to log sequence 272986
    Current log# 6 seq# 272986 mem# 0: /rollback_logs/FC/redoFC06.log
    Fri May 4 07:15:53 2007
    Thread 1 advanced to log sequence 272987
    Current log# 7 seq# 272987 mem# 0: /rollback_logs/FC/redoFC07.log
    Fri May 4 07:16:18 2007
    Thread 1 advanced to log sequence 272988
    Current log# 8 seq# 272988 mem# 0: /rollback_logs/FC/redoFC08.log
    Fri May 4 07:20:20 2007
    Thread 1 advanced to log sequence 272989
    Current log# 9 seq# 272989 mem# 0: /rollback_logs/FC/redoFC09.log
    Fri May 4 07:20:45 2007
    Thread 1 advanced to log sequence 272990
    Current log# 10 seq# 272990 mem# 0: /rollback_logs/FC/redoFC10.log
    Fri May 4 07:21:09 2007
    Thread 1 advanced to log sequence 272991
    Current log# 11 seq# 272991 mem# 0: /rollback_logs/FC/redoFC11.log
    Fri May 4 07:25:21 2007
    Thread 1 advanced to log sequence 272992
    Current log# 2 seq# 272992 mem# 0: /rollback_logs/FC/redo02.log
    Fri May 4 07:25:45 2007
    more

  • Alter database clear unarchived logfile group... who, what?

    I am the sole DBA for our site, all of them running RHEL 5, Oracle 11.2.0.3.
    I recently (within the last hour), received a text message from one of our databases that poll the alert.log...
    ORA-1031 signalled during: ALTER DATABASE CLEAR UNARCHIVED LOGFILE GROUP 3
    Unfortunately, the 'audit database' was not enabled (it is now!), and the trace file generated did not contain anything of use.
    I know someone has been loading data since 1:30pm up until near the time I received this text, and I'm wondering if he is mucking in the system, or if this command can somehow be generated automatically by Oracle. If so, I certainly wouldn't expect an ORA-1031insufficient permissions error....
    I checked my v$log, v$logfile, and did a log switch just to check if any possibility of redo log corruption, but all looks fine.
    Has anyone else ever had random Oracle errors like this?....

    Hi,
    That's someone manually doing something when they really don't know what they are doing. I've only had to run that command once in 16 years as a dba. Oracle wouldn't ever run that itself.
    Cheers,
    Harry

  • Audit specific objects for specific users

    audit statement has the option to choose audit by user list
    audit object has the option to choose audited objects
    now i need to audit specific objects, i.e. user A's tables accessed by a specific group of users, let's say ALL users other than A
    Is it a simple way to achieve this goal? (audit A's tables that accessed by all database users other than A)
    Thanks!

    sorry, the link works now. However, there is nothing new in 10G, same as I read from 9i document. See my highlight below in the quoted document text, my requirements is the combination of them ( specific users and specific objects). Thanks anyway.
    <quote
    Table 8-1 Auditing Types and Descriptions
    Type of Auditing (link to discussion)      Meaning/Description
    Statement Auditing      Enables you to audit SQL statements by type of statement, not by the specific schema objects on which they operate. Typically broad, statement auditing audits the use of several types of related actions for each option. For example, AUDIT TABLE tracks several DDL statements regardless of the table on which they are issued. You can also set statement auditing to audit selected users or every user in the database.
    Privilege Auditing
         Enables you to audit the use of powerful system privileges that enable corresponding actions, such as AUDIT CREATE TABLE. Privilege auditing is more focused than statement auditing, which audits only a particular type of action. You can set privilege auditing to audit a selected user or every user in the database.
    Schema Object Auditing
         Enables you to audit specific statements on a particular schema object, such as AUDIT SELECT ON employees. Schema object auditing is very focused, auditing only a single specified type of statement (such as SELECT) on a specified schema object. Schema object auditing always applies to all users of the database.
    Fine-Grained Auditing
         Enables you to audit at the most granular level, data access and actions based on content, using any Boolean measure, such as value > 1,000,000. Enables auditing based on access to or changes in a column.
    /quote>

  • Trying to configure syslog process,to write the database audit logs

    Folks,
    Running Oracle 10g R2 on Sun Solaris v 10.
    I am trying to configure my database environment, so it will write all the database audit logs to a location, where Oracle userid on unix cannot modify/delete it.
    To accomplish my goal, so far I have done the following:
    I have set the following parameter with these values
    audit_file_dest /flood/u01/app/oracle/product/10.2.0/db_1/rdbms/audit
    audit_sys_operations TRUE
    audit_trail OS
    Also I asked my system administrator , to make an entry in the syslog.conf file at location /etc
    He made the following entry
    local3.notice /var/log/oraaudit.log
    and restarted the syslog process
    I also made the following entry
    alter system set audit_syslog_level='LOCAL3.NOTICE' scope=spfile and bounced the database.
    But after starting the database, i will don't see any oraaudit.log file at the location /var/log
    Any help will be much appreciated.
    Regards
    Ashish

    Hello Srini,
    I mentioned in my posting , that I already set AUDIT_SYSLOG_LEVEL=LEVEL3.NOTICE value.
    Also the permission on /var/log is such the Oracle unix userid cannot write to it and that is what I want. Since if Oracle userid can write, it can modify/delete the audit log also , which we are trying to prevent.
    Thanks
    Ashish

  • Oracle hands for 12 min during "alter database open"

    Dear all,
    After a disk failure/replacement in a SAN disk array that we are using for storage, we had to restore our Oracle database. After the restore the database does not start properly: It takes around 12 min to move from the state "Mount" to the state "Open". It finally opens but even after this, when I start SAP, only 5 workprocesses connect and logging into SAP is not possible, the gui just hangs
    There are no errors in the alert_RSP.log. I attach an extract here to show the time difference between the mount state and the open state
    Thu Apr 19 11:16:07 2007
    Starting ORACLE instance (normal)
    Thu Apr 19 11:16:29 2007
    LICENSE_MAX_SESSION = 0
    LICENSE_SESSIONS_WARNING = 0
    SCN scheme 3
    LICENSE_MAX_USERS = 0
    SYS auditing is disabled
    Starting up ORACLE RDBMS Version: 9.2.0.7.0.
    System parameters with non-default values:
      processes                = 240
      sessions                 = 288
      timed_statistics         = TRUE
      event                    = 38068 trace name context forever, level 100
      shared_pool_size         = 620756992
      sga_max_size             = 1159695232
      shared_pool_reserved_size= 20401094
      java_pool_size           = 167772160
      enqueue_resources        = 8000
      filesystemio_options     = SETALL
      control_files            = /oracle/RSP/sapdata1/cntrl/cntrlRSP.dbf, /oracle/RSP/origlogA/cntrl/cntrlRSP.dbf, /oracle/RSP/sa
    parch/cntrl/cntrlRSP.dbf
      db_block_checksum        = FALSE
      db_block_size            = 8192
      compatible               = 9.2.0
      log_archive_start        = TRUE
      log_archive_dest         = /oracle/RSP/saparch/RSParch
      log_buffer               = 1048576
      log_checkpoint_interval  = 0
      log_checkpoint_timeout   = 0
      db_files                 = 254
      db_file_multiblock_read_count= 8
      log_checkpoints_to_alert = TRUE
      control_file_record_keep_time= 30
      dml_locks                = 5000
      replication_dependency_tracking= FALSE
      transaction_auditing     = FALSE
      undo_management          = AUTO
    undo_tablespace          = PSAPUNDO
      undo_suppress_errors     = TRUE
      undo_retention           = 43200
      remote_os_authent        = TRUE
      db_domain                = WORLD
      session_cached_cursors   = 800
      hash_join_enabled        = FALSE
      background_dump_dest     = /oracle/RSP/saptrace/background
      user_dump_dest           = /oracle/RSP/saptrace/usertrace
      max_dump_file_size       = 20000
      core_dump_dest           = /oracle/RSP/saptrace/background
      optimizer_features_enable= 9.2.0
      sort_area_size           = 2097152
      sort_area_retained_size  = 0
      db_name                  = RSP
      open_cursors             = 800
      optimizer_mode           = choose
      sortelimination_cost_ratio= 10
      btree_bitmap_plans     = FALSE
      pushjoin_predicate     = FALSE
      optimizerjoin_sel_sanity_check= TRUE
      optimizer_index_cost_adj = 10
      optimpeek_user_binds   = FALSE
      optimizeror_expansion  = DEPTH
    PMON started with pid=2
    DBW0 started with pid=3
    DBW1 started with pid=4
    DBW2 started with pid=5
    DBW3 started with pid=6
    LGWR started with pid=7
    CKPT started with pid=8
    SMON started with pid=9
    RECO started with pid=10
    Thu Apr 19 11:16:31 2007
    ARCH: STARTING ARCH PROCESSES
    ARC0 started with pid=11
    ARC0: Archival started
    ARC1 started with pid=12
    ARC1: Archival started
    Thu Apr 19 11:16:31 2007
    ARCH: STARTING ARCH PROCESSES COMPLETE
    Thu Apr 19 11:16:31 2007
    ARC0: Becoming the 'no FAL' ARCH
    ARC0: Becoming the 'no FAL' ARCHARC0: Thread not mounted
    Thu Apr 19 11:16:31 2007
    ARC1: Becoming the heartbeat ARCH
    ARC1: Becoming the heartbeat ARCHARC1: Thread not mounted
    Thu Apr 19 11:16:31 2007
    ALTER DATABASE   MOUNT
    Thu Apr 19 11:16:36 2007
    Successful mount of redo thread 1, with mount id 1209727119
    Thu Apr 19 11:16:36 2007
    Database mounted in Exclusive Mode.
    Completed: ALTER DATABASE   MOUNT
    Thu Apr 19 11:16:36 2007
    ALTER DATABASE OPEN
    Thu Apr 19 11:16:37 2007
    LGWR: Primary database is in CLUSTER CONSISTENT mode
    Thread 1 opened at log sequence 6727
      Current log# 12 seq# 6727 mem# 0: /oracle/RSP/origlogB/log_g12m1.dbf
      Current log# 12 seq# 6727 mem# 1: /oracle/RSP/mirrlogB/log_g12m2.dbf
    Successful open of redo thread 1
    Thu Apr 19 11:16:37 2007
    MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
    Thu Apr 19 11:16:38 2007
    SMON: enabling cache recovery
    Thu Apr 19 11:16:49 2007
    Successfully onlined Undo Tablespace 27.
    Thu Apr 19 11:16:49 2007
    SMON: enabling tx recovery
    Thu Apr 19 11:16:50 2007
    Database Characterset is WE8DEC
    Thu Apr 19 11:29:09 2007
    Completed: ALTER DATABASE OPEN
    Please note the time difference between 11:16:50 and 11:29:09, when the database is mounted and we are just waiting for it to open
    I run dbverify, all ok
    I reviewed note 521264 and my issue is described in case 2c. However, after reviewing all 127 datafiles and online redologs, I do not have any files with an "S" in their permissions
    We run Solaris 10, Oracle 9.2.0.7 and WAS 6.40 SP16
    Any help will be very much appreciated
    Many thanks
    Andreas

    Hello,
    Here are the details:
    R3trans -d returns 0000 instantly. I am not including trans.log here as the connection to the database works . I have no space issues neither, have around 70GB left under /oracle
    The startup log is as follows
    Trace of system startup/check of SAP System RSP on Fri Apr 20 08:38:10 BST 2007
    Called command: /usr/sap/RSP/SYS/exe/run/startsap
    Starting SAP Instance DVEBMGS00
    SAP-R/3-Startup Program Rel 640 V1.8 (2003/04/24)
    Starting at 2007/04/20 08:38:10
    Startup Profile: "/usr/sap/RSP/SYS/profile/START_DVEBMGS00_rspda002"
    Execute Pre-Startup Commands
    (6285) Local: /usr/sap/RSP/SYS/exe/run/sapmscsa -n pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    /usr/sap/RSP/SYS/exe/run/sapmscsa: SCSA is attached and useable.
    /usr/sap/RSP/SYS/exe/run/sapmscsa: finished.
    (6285) Local: rm -f ms.sapRSP_DVEBMGS00
    (6285) Local: ln -s -f /usr/sap/RSP/SYS/exe/run/msg_server ms.sapRSP_DVEBMGS00
    (6285) Local: rm -f dw.sapRSP_DVEBMGS00
    (6285) Local: ln -s -f /usr/sap/RSP/SYS/exe/run/disp+work dw.sapRSP_DVEBMGS00
    (6285) Local: rm -f co.sapRSP_DVEBMGS00
    (6285) Local: ln -s -f /usr/sap/RSP/SYS/exe/run/rslgcoll co.sapRSP_DVEBMGS00
    (6285) Local: rm -f se.sapRSP_DVEBMGS00
    (6285) Local: ln -s -f /usr/sap/RSP/SYS/exe/run/rslgsend se.sapRSP_DVEBMGS00
    Starting Programs
    (6304) Starting: local ms.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    (6305) Starting: local dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    (6306) Starting: local co.sapRSP_DVEBMGS00 -F pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    (6307) Starting: local se.sapRSP_DVEBMGS00 -F pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    (6285) Waiting for Child Processes to terminate.
    Instance on host rspda002 started
    ps -ef | grep dw is shown below: It only starts 5 -6 dialog processes. All the other processes are not started (normally I have around 40 )
    rspda002:rspadm 33% ps -ef | grep dw
      rspadm  6317  6305   0 08:38:17 ?           0:00 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6310  6305   0 08:38:16 ?           0:01 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6311  6305   0 08:38:16 ?           0:00 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6624  5523   0 08:43:35 pts/1       0:00 grep dw
      rspadm  6305  6285   0 08:38:11 ?           0:04 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6312  6305   0 08:38:17 ?           0:01 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6313  6305   0 08:38:17 ?           0:00 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    That is ps -ef | grep sap
    rspda002:rspadm 32% ps -ef | grep sap
      rspadm  6317  6305   0 08:38:17 ?           0:00 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6310  6305   0 08:38:16 ?           0:01 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
        root 12375   650   0 11:15:58 ?           3:56 /usr/sap/RSP/SYS/exe/run/saposcol
      rspadm  6311  6305   0 08:38:16 ?           0:00 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6309  6305   0 08:38:16 ?           0:01 icman -attach pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6306  6285   0 08:38:11 ?           0:00 co.sapRSP_DVEBMGS00 -F pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6307  6285   0 08:38:11 ?           0:00 se.sapRSP_DVEBMGS00 -F pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6304  6285   0 08:38:11 ?           0:00 ms.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6308  6305   0 08:38:16 ?           0:02 gwrd -dp pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6622  5523   0 08:43:29 pts/1       0:00 grep sap
      rspadm  6305  6285   0 08:38:11 ?           0:04 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm 20243   650   0 15:11:34 ?          13:11 sapccm4x -DCCMS pf==/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6285   650   0 08:38:11 ?           0:00 /usr/sap/RSP/SYS/exe/run/sapstart pf=/usr/sap/RSP/SYS/profile/START_DVEBMGS00_r
      rspadm  6312  6305   0 08:38:17 ?           0:01 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
      rspadm  6313  6305   0 08:38:17 ?           0:00 dw.sapRSP_DVEBMGS00 pf=/usr/sap/RSP/SYS/profile/RSP_DVEBMGS00_rspda002
    Many thanks
    Andreas

  • Alter database compared to alter system

    Hi all,
    Please,I think -and I hope I'm not wrong- that we use ALTER SYSTEM to modify the value of an initialization parameter.But when do we use alter database?
    Thanks.

    ALTER SYSTEM - applicable to the specific instance. It will be more clear if you think of a RAC environment - where one can alter the properties for a particular instance (system).
    ALTER DATABASE - applicable to the physical aspects of the databases f.ex. data files.

  • What is the use of 'ALTER DATABASE CLOSE'?

    Hello Everybody,
    SQL*Plus: Release 10.1.0.2.0 - Production on Ma Aug 15 21:28:30 2005
    Copyright © 1982, 2004, Oracle. All rights reserved.
    Connected to:
    Oracle Database 10g Enterprise Edition Release 10.1.0.2.0 - Production
    With the Partitioning, OLAP and Data Mining options
    SQL> conn / as sysdba
    Connected.
    SQL> startup force
    ORACLE instance started.
    Total System Global Area 171966464 bytes
    Fixed Size 787988 bytes
    Variable Size 145750508 bytes
    Database Buffers 25165824 bytes
    Redo Buffers 262144 bytes
    Database mounted.
    Database opened.
    SQL> select status from v$instance;
    STATUS
    OPEN
    SQL> alter database close;
    Database altered.
    SQL> select status from v$instance;
    STATUS
    MOUNTED
    SQL> alter database open;
    alter database open
    ERROR at line 1:
    ORA-16196: database has been previously opened and closed
    If i have to shutdown the instance and database then
    WHAT IS THE USE OF 'ALTER DATABASE CLOSE' ?
    I need explanation. Why should i shutdown?
    Dont give me this answer.
    ORA-16196: database has been previously opened and closed
    Cause: The instance has already opened and closed the database, which is allowed only once in its lifetime.
    Action: Shut down the instance.

    If you read the documentation you will see that there is no ALTER DATABASE CLOSE command.
    This is an undocumented Oracle command, which we are not supposed to use. Consequently we are not allowed to complain about the way that it works. Instead we're supposed to use SHUTDOWN IMMEDIATE.
    Cheers, APC

Maybe you are looking for