Audit File
Is there a way to receive a audit report from Tidal that will show when a job started.
Example: Audit report would show the following statues.
Waiting on Resources - Job launched - Active - Job Completed Normally.
It can be done using the reporting functions. This would be via Tidal Intelligent Reporting in v5 or through the JAWS framework in V6. We've also done our own thing by tying the TIR database into our corporate reporting tools so we can create custom reports along the lines you are talking about.
In theory you could also do this directly from the main database but for performance reasons you might not want to go down this route.
Cheers
Similar Messages
-
Auditing file server setup issues - nfs permissions
I have half-dozen Solaris 10 workstations requiring Solaris Auditing enabled and audit files saved. I used a spare Solaris 10 system with 2-72GB disks and formatted 2nd disk for entired 72GB. I shared out the 72GB partition on this system and modified /etc/security/audit_control on a test Solaris 10 W/S to use the shared-out partition on Audit file server as primary audit directory. Following directions in Solaris 10 Admin Gde I chmod -R 750 the mount pt using the 72GB partition before sharing out the partition. However, all client W/S's that I enable Auditing would not use the 72GB partition on file server until I went back and chmod 777 the partition and rebooting file server. Also, on any client that I have enabled Auditng to use nfs-mounted 72GB partion on file server I cannot as a non-root user issue a "df -k" command without getting error:
df: cannot statvfs /var/audit/fmaud.1/files: Permission denied
Is this normal or did I miss a chmod step or two in setting up Audit clients and/or Audit file server?The roundcube db schema needs to setup manually. See /usr/share/webapps/roundcube/INSTALL
Also, from your /etc/webapps/postfixadmin/config.inc.php:
$CONF['domain_path'] = 'NO';
$CONF['domain_in_mailbox'] = 'YES';
$CONF['maildir_name_hook'] = 'NO';
..which results in /var/mail/vmail/[email protected]
From your dovecot.conf
mail_home = /var/mail/vmail/%d/%u
...which results in /var/mail/vmail/domain.com/user
That doesn't fit together. -
How to change the Time Zone in OAM log & audit files
Hi All,
I have OAM installed with all components. By default it is using the UTC Time Zone in the log files and Audit files.
Could any one please tell me how to change the Time according to the place ?
It is an urgent plzzz.
Thanks & Regards,
Vaasu.could you find how to change the tine zone. i am also getting this problem
thanks -
On a SBS 2011 Server, I've enabled the Object Access Audit File System Success.
When checking the logs I see mostly read attributes activity.
Reading attributes seems to cloud the logs.
How can this be configured to capture only deletions, creations and updates?Hi,
Just checking in to see if the suggestion was helpful. Please let us know if you would like further assistance.
TechNet Subscriber Support
If you are
TechNet Subscription
user and have any feedback on our support quality, please send your feedback
here.
Regards, Yan Li -
Essbase Audit Files not Updating
Hi All,
My Essbase Audit files are not updating....both .ALG and .ATX files.
They used to update up to the last month but those are not updating.
I checked the .cfg file and is okay with SAUDITR.
Please suggest.Some of the terminology Dreamweaver uses can make what you're saying a bit confusing, so I'm going to try to clarify so we can better understand the situation.
You and your coworker are each on your work computers using Dreamweaver. You have both created site definitions in Dreamweaver, pointing to a folder on your company's internal server.
The "Local Site Folder" setting of your site definition should be pointing to a location on your own computer. The same setting on your coworker's site definition in Dreamweaver should be pointing to a location on their computer.
This means that when you select "Local view" in the Files panel, it will only show files on your computer. Likewise, when your coworker does the same, it will only show files on their computer.
It is the "Server Folder" setting in the server settings on each of your computers that should be pointing to that folder on your company's internal server.
This means that when you select "Remote Server" (or "Testing Server" if you checked that box instead for the server in your site definition) in the Files panel, you will be viewing the files on your company's server.
In order to essentially share files between your copy of Dreamweaver and your coworker's, you need to "upload" (i.e. copy) files from your Local View to your Remote Server. Your coworker would then see these files by looking at Remote Server on their computer. And the reverse is true; they upload from Local View to Remote Server, and you would see the files by looking at the Remote Server view on your computer.
Hope this helps. -
Audit Files Not Updating in Essbase
Hi Experts,
Audit files are not updating.( alg and .atx).
The two audit files were updating previously but for the last two months they are not updating.
Please suggest me.Some of the terminology Dreamweaver uses can make what you're saying a bit confusing, so I'm going to try to clarify so we can better understand the situation.
You and your coworker are each on your work computers using Dreamweaver. You have both created site definitions in Dreamweaver, pointing to a folder on your company's internal server.
The "Local Site Folder" setting of your site definition should be pointing to a location on your own computer. The same setting on your coworker's site definition in Dreamweaver should be pointing to a location on their computer.
This means that when you select "Local view" in the Files panel, it will only show files on your computer. Likewise, when your coworker does the same, it will only show files on their computer.
It is the "Server Folder" setting in the server settings on each of your computers that should be pointing to that folder on your company's internal server.
This means that when you select "Remote Server" (or "Testing Server" if you checked that box instead for the server in your site definition) in the Files panel, you will be viewing the files on your company's server.
In order to essentially share files between your copy of Dreamweaver and your coworker's, you need to "upload" (i.e. copy) files from your Local View to your Remote Server. Your coworker would then see these files by looking at Remote Server on their computer. And the reverse is true; they upload from Local View to Remote Server, and you would see the files by looking at the Remote Server view on your computer.
Hope this helps. -
Auditing file share on windows 2008 R2
I think I may need a little handholding here. I have been working with our new Windows 2008 R2 file server. I am having a problem doing some simple file level auditing.
I turned on Audit Object Access in the local policy. The GPO that applies to this server does not have it set and I only really need it enabled on this server. I have it auditing success and Failure.
After I did that I got deluged with Event ID: 5145. I went to each folder and made sure that I had auditing turned off for each folder and file. I did that to see if it would quite down the logs a little. It did not. I am currently getting about 1500 events of 5145 every second. They all say “ A network share object was checked to see whether client can be granted desired access”
Most of the details look like this:
- System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 5145
Version 0
Level 0
Task 12811
Opcode 0
Keywords 0x8020000000000000
- TimeCreated
[ SystemTime] 2009-10-21T17:27:06.988998000Z
EventRecordID 4035441
Correlation
- Execution
[ ProcessID] 528
[ ThreadID] 544
Channel Security
Computer XXXXX-File.XXXXX.com
Security
- EventData
SubjectUserSid S-1-5-21-619530815-2141852887-1629300891-2071
SubjectUserName SteveW
SubjectDomainName XXXXXXXXXX
SubjectLogonId 0x223b087c
ObjectType File
IpAddress 10.2.50.88
IpPort 1087
ShareName \\*\users
ShareLocalPath \??\E:\shares\users
RelativeTargetName \
AccessMask 0x1
AccessList %%4416
AccessReason %%4416: %%1801 D:(A;OICI;FA;;;WD)
All I am trying to keep track of at this point is logon and logoff events AND files and folders being deleted.
If I have put this into the wrong folder please let me know.Hi all,
I enabled File System Audit and NFTS audit only "Delete subfolders and files"
auditpol /get /category:"Object Access"
System audit policy
Category/Subcategory Setting
Object Access
File System Success and Failure
Registry No Auditing
Kernel Object No Auditing
SAM No Auditing
Certification Services No Auditing
Application Generated No Auditing
Handle Manipulation No Auditing
File Share No Auditing
Filtering Platform Packet Drop No Auditing
Filtering Platform Connection No Auditing
Other Object Access Events No Auditing
Detailed File Share No Auditing
I try to delete files but don't see any 4463 event. -
How to copy OS audit files into DB
Hello All!,
I'm wondering if there is a possibility to manage OS audit files from database.
We've a lot of audit files in /u01/app/oracle/admin/******/adump directory that need to be copied into database.
Of course audit_trail should be set to DB but I need to restore all audits as well.
SQL> show parameters audit;
NAME TYPE VALUE
audit_file_dest string /u01/app/oracle/admin/******/adump
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string OS
Do you know how can I copy information from files back to DB or read them somehow directly from the database?
DB version 10.2.0.3, OS RHEL
Thank you!I would concatenate them into single file & then use EXTERNAL TABLE to allow reading content into DB
-
I want to audit file and folder access auditing on a windows 2008 server. I need to enable audit log all file activity by user such as read, copy, create, rename, deleted .
Is there a way to see if an user access a specific file ?
ThanksHey please have a look at these link for the reference.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/b18ca99b-db07-4e2e-8f13-67d58a4d1c63/windows-2008-server-files-access-real-time-monitoring
Moreover, you can start from the several links from here also
http://technet.microsoft.com/en-us/library/dd408940%28v...
http://technet.microsoft.com/en-us/sysinternals/bb89664...
http://technet.microsoft.com/en-us/library/cc721946.asp...
And the other option is you can opt for a third party tool such as Lepide Auditor For File Server. A file Server monitoring tool that would help you in case for a real time monitoring.Test the tool from the given link below.
http://www.lepide.com/file-server-audit/
Thanks. -
Audit files utilizing more space in the hard disk
Hi All,
In my system, audit files are created in a huge size.
Sometimes, it will be 4 to 5 GB and sometimes 1000 files with 300MB each.
What could be reason for this repeat audit files.You initially posted this question to a hardware forum.
It's not a hardware question, but rather is a system administration question.
Your issue is outside the scope of a hardware forum.
I'll be asking the forum moderators to move it to a location where it will be more on-topic.
Maybe someone over there will be interested in providing suggestions. -
EM GC11.1 ASM Audit files
Hi,
having a question about OEMGC 11.1 and connecting as SYSASM to an ASM instance.
EM connects every minute to our oracle 11.2 ASM instance. ASM 11.2 write an audit file on connect as sysasm.
Does OEMGC 11.1 really need sysasm privs or could we create a low priv user to operate
in GC ?
*T
Edited by: tbrinkmann on Dec 8, 2011 5:02 AMHi,
You need a user with sysdba privileges: asmsys, sys or you can create a user with the same privileges as asmsys -
Tax Audit file (Taxware) is updated real-time from SAP
This is an issue when there are server issues, disaster recover, or any connection issues. I do not see a way in RFYTXDISPLAY to control the update. Does anyone know how to make it so that the updates to external tax audit file is done in batch instead of real-time?
What release of SAP are you on? In some older releases, SAP provided update programs to do what you ask. If SAP is down, there are no transactions and no taxes to update. If Taxware is down, the updates are queued in SMQ1. You can, once Taxware is up, release all the updates.
-
Hello Friends,
As a part of re-platform activity our production application servers are moved from AIX to Windows operating system. But CI is still in AIX.
From the next day of re-platform activity we are getting the SM21 error log as "Cannot open audit file: /migrate/<SID>/audit/log\<DATE>.AUD. This log is generating only on Windows application servers and not on CI(AIX).
All the file systems are properly mounted from AIX to Windows.
DIR_AUDIT parameter value also maintained in default profile as /migrate/<SID>/audit/log
Can any one please suggest
Thanks in advance,
Mahi.Hi ,
Some parameters which might help you for this"
Name Description
FN_AUDIT Name of security audit file audit_++++++++
DIR_AUDIT Directory for security audit files
*rsau/enable Enable Security Audit*
rsau/max_diskspace/local Maximum space for security audit file
rsau/max_diskspace/per_day Maximum size of all security audit files per day
rsau/max_diskspace/per_file Maximum size of one single security audit file
rsau/selection_slots Number of selection slots for security audit
rsau/user_selection Defines the user selection method used inside kernel functions
Also refer to the SAP Note:: 539404 - FAQ: Answers to questions about the Security Audit Log
Please do the cross check of the related param's and also check the SAP note which might be very helpful.
Regards,
Sanjeev Nagalikar -
After shutdown our 8.1.7.4 database had a datafile change to the audit_data_01.dbf file. (4 hours later). Unfortunately, we were moving the database to a new server the next day and are now unable to bring the database back up. Error is that the file (51337) is smaller than the correct size of 64k. Actual size of file is 420mb. Original server has the file at the same size as moved so old and new are still identical. What happened and what can I do to bring the database back up?
All processes were down prior to the move.
Audit init file parameter was set to true.apparently there is not a cron that could have affected the file so it must have been a backup or a transfer/tar failure. I'll have to check tomorrow when I go in to see if the audit file is in a separate tablespace. I didn't create these databases, they've been around for several years. It is not named consistently with the other appication files so we are not sure how it was created. Losing the data/change after the shutdown will not be an issue. It looks at this time like we're facing either a recover database until time x recovery, a datafile recovery or a database recovery tomorrow morning. Any advice on which to try first? or which is most likely to work without causing further damage? or alternatives?
-
Hai All,
In my database 3 or more audit files generated in every minute . The OS is sun ...veritas clustering used. Due to the huge generation of audit files the disk is fill with thes files. How to resolve this issue without disable the sudit generation?
Shiju
All audit fiile's content look like.....(below)
Audit file /oracle/app/product/9.2.0/oracle9/rdbms/audit/ora_5284.aud
Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Oracle Data Mining options
JServer Release 9.2.0.1.0 - Production
ORACLE_HOME = /oracle/app/product/9.2.0/oracle9
System name: SunOS
Node name: node1
Release: 5.8
Version: Generic_117350-25
Machine: sun4u
Instance name: wg92
Redo thread mounted by this instance: 1
Oracle process number: 30
Unix process pid: 5284, image: oracle@node1 (TNS V1-V3)
Thu Feb 15 13:28:37 2007
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: oracle9
CLIENT TERMINAL:
STATUS: 0Why do you have so many connections as SYSDBA per minute? If there is genuine need to have many connections as SYSDBA per minute you can create a job to backup (if needed) and purge the audit files on a regular basis.
-
Taxware configuration to prevent writing to external audit file
We have a 3 instance system with each instance supporting a different company.
I need to know how I can prevent SAP from writing to the external tax audit file. I will use the data from within SAP to report taxes.
I could not find anything on the Taxware side, which informed me that some thing needs to be done on the SAP side and a search of SAP docs and sites has returned nothing regarding this.
Any help will be greatly appreciated.
Thanks in advance.Hi Andrew,
Thanks for your response, and I did try your suggestion. However, I needed to make some modifications since I wanted Labview Write vi to start writing RIGHT AWAY, for 5 secs, and then stop, which is exactly opposite so I used an "inverter" to invert the boolean logic coming out of the "time elapsed" vi to turn on the Labview Write vi.
One thing about this "time elapsed" vi that puzzles me is that it needs to be put into a While loop for it to work, if don't do that, then the elapsed time stays at "0" for some reason meaning it's not counting time at all!! So I had to enclose it within a While-Loop. I have a couple of questions.
1. Why does the "time elapsed" vi need to be working in a while loop? I've tried running the LabView program in a "Run Continuously" mode as opposed to "Run" mode, the elapsed time simply stays at zero.. don't know why..
2. What's the difference running a Labview code at "Run Continuously" mode or just enclose everything inside a while loop and "Run" ?
I've attached my modified script that'll correctly write to file for 5 sec and turn off. It seems so verbose for such a simple task.
Jeff
Attachments:
Creping_Force_Data_timedwriting21.vi 799 KB
Maybe you are looking for
-
How can i add my itunes library to my iphone?
how can I add my itunes library to my iphone. when i sync no music is added?
-
Hi, When I design an Adobe interactive form in transaction FSP, is there a way to use that form from within Webdyn pro for Java (and vice versa)? thanks, Jeroen
-
Message personalizations not visible in WebAccess
Running GW 8.0.2 When personalizing a message (such as changing the subject line) using the full GW client (PC, Mac, or Linux), the personalization doesn't show up in WebAccess. It does from any other platform. -Barry.
-
I have exhausted all available options and could not get my 20g Ipod to work. I finally decided to return it via the internet, but it won't let me do so. It says that my serial number is not correct. Any suggestions?
-
ITunes 8.2.1 nonresponsive in Vista Home Premium
I have seen topics similar to this one, but none have been answered to my satisfaction. Please help me, if you can: I cannot open iTunes v.8.2.1 on my computer. I could open all previous versions just fine, but when clicking on the shortcut on my tas