Audit log AUD$ table and Query...

We have enabled auditing for DB user ERP, 'DB, EXTENDED', we restored our ERP schema day before yesterday, and today When I checked the log file, its size is 4.3GB, before that the file size was 60 MB.
When I queried to check the total rows with sysdate-1, there are 66,60,756 rows, before the ERP schema restoration there were around 30,000 rows.
I have not changed the query.
The AUD$ table size is increasing rapidly, its size has become over 10GB in two days.
PLease help me... what should I do?
Regards,
Rakesh Soni,
http://rakeshocp.blogspot.com/

Purging an AUD$ table is good idea after taking the export....
Yeah...that could be better idea to audit those things that application skips...
I was just getting calls from finance and operations departments... complaining that their ERP applications were haning taking long time to execute day end procedures and in reports...around 20 to 30 minutes.... as I recalled that my last deployment on live was enabling of auditing as I executed noaudit all and noaudit select, update, delete, insert on erp, The user got their day end procedures executed and report in less than 1 minute...
Can anybody explain me....Does auditing degrades performance..?
Regards?

Similar Messages

Audit logs for tables

Dear all,
I have a requirement of implementing audit logs for tables to insert,update,delete operations. Is there any way to achieve this since triggers are present only for insert,update and delete ?
I am using database 9.2.0.3.
thanks in advance.

Hi,
After I turn on audit trail on the database sever and issue DML statment. I have found nothing in the audit table.
1) Set "audit_trial" = true in teh init.ora file
2) Run the $ORACLE_HOME/rdbms/admin/cataudit.sql
3) Connect sys/password by sysdba and issue the following command:
- AUDIT SELECT TABLE, UPDATE TABLE, INSERT TABLE, DELETE TABLE BY APPS BY ACCESS;
Do I need to re-set the database after step 1? or I have made some wrong.
Thanks.

How to see lock on table and query?

Hi All,
How do we see lock on table and query?
Thanks,
Rafi

Yes Rafi,
It is working fine at my end. See below:
Opened Session 1 with scott/tiger and:
update emp set ename='xx' where empno=7499;
Opened Session 2 with scott/tiger and:
update emp set ename='xx' where empno=7499;
<<Its lock here>> This session is locked by above one.
Opened Session 3 with sys/pw as sysdba and:
SQL> set serveroutput on
SQL> BEGIN
2 dbms_output.enable(1000000);
3 for do_loop in (select session_id, a.object_id, xidsqn, oracle_username, b.owner owner,
4 b.object_name object_name, b.object_type object_type
5 FROM v$locked_object a, dba_objects b
6 WHERE xidsqn != 0
7 and b.object_id = a.object_id)
8 loop
9 dbms_output.put_line('.');
10 dbms_output.put_line('Blocking Session : '||do_loop.session_id);
11 dbms_output.put_line('Object (Owner/Name): '||do_loop.owner||'.'||do_loop.object_name);
12 dbms_output.put_line('Object Type : '||do_loop.object_type);
13 for next_loop in (select sid from v$lock
14 where id2 = do_loop.xidsqn
15 and sid != do_loop.session_id)
16 LOOP
17 dbms_output.put_line('Sessions being blocked : '||next_loop.sid);
18 end loop;
19 end loop;
20 END;
21 /
Blocking Session : 139
Object (Owner/Name): SCOTT.EMP
Object Type : TABLE
Sessions being blocked : 134
PL/SQL procedure successfully completed.HTH
Girish Sharma

Lookup-table and query-database do not use global transaction

Hi,
following problem:
DbAdapter inserts data into DB (i.e. an invoice).
Process takes part in global transaction.
After the insert there is a transformation which uses query-database and / or lookup-table.
It seems these XPath / XSLT functions are NOT taking part in the transaction and so we can not access information from the current db transaction.
I know workarounds like using DbAdapter for every query needed, etc. but this will cost a lot of time to change.
Is there any way to share transaction in both DbAdapter insert AND lookup-table and query-database?
Thanks, Best Regards,
Martin

One dba contacted me and made this statement:
Import & export utilities are not independent from characterset. All
user data in text related datatypes is exported using the character set
of the source database. If the character sets of the source and target
databases do not match a single conversion is performed.So far, that does not appear to be correct.
nls_characterset = AL32UTF8
nls_nchar_characterset = UTF8
Running on Windows.
EXP produces a backup in WE8MSWIN1252.
I found that if I change the setting of the NLS_LANG registry setting for my oracle home, the exp utility exports to that character set.
I changed the nls_lang
from AMERICAN_AMERICA.WE8MSWIN1252
to AMERICAN_AMERICA.UTF8
Unfortunately , the export isn't working right, although it did change character sets.
I get a warning on a possible character set conversion issue from AL32UTF8 to UTF8.
Plus, I get an EXP_00056 Oracle error 932 encountered
ORA-00932: inconsistent datatypes: expected BLOB, CLOB, get CHAR.
EXP-00000: export terminated unsuccessfully.
The schema I'm exporting with has exactly one procedure in it. Nothing else.
I guess getting a new error message is progress. :)
Still can't store multi-lingual characters in data tables.

How to Audit log T000 table

Hi all,
We have got one requirement from security team to check the possibulity of sending automatic emails alerts when some body open the system thru SCC4 , means we need to activate the change logs on T000 table and send email to security team when somebody opens the system.
Change logs activation is fine but need help on how to send automatic emails when scc4 is opened..
Please suggest ..
Thanks,
Subhash.G

we created an SQL script at Os level and whenever status changes in tables:
TADIR for SE06
T000 for SC4
I cannot supply that script, but you get the idea.

Audit/Log GPO changes and Logging of new addition of Domain Controllers in the Event Log

Hi all,
We am trying to log the following items in the event log for Windows 2012. This applies to a domain controller.
1) Audit any changes made to the Group Policy
2) Log the addition of new domain controllers added to the system.
We need the windows event log to record the above events for security purposes. Can anyone advise if this is doable? If yes what are the steps.
Thank you

Hi,
>>1) Audit any changes made to the Group Policy
We can enable audit for directory service object access and configure specific SACL for group policy files to do this.
Regarding how to step-to-step guide for auditing changes of group policy, the following two blogs can be referred to for more information.
Monitoring Group Policy Changes with Windows Auditing
http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447951.aspx
Auditing Group Policy changes
http://blogs.msdn.com/b/canberrapfe/archive/2012/05/02/auditing-group-policy-changes.aspx
>>2) Log the addition of new domain controllers added to the system.
Based on my knowledge, when a server is successfully promoted to be domain controller, event ID 29223 will be logged in the System log.
Regarding this point, the following thread can be referred to for more information.
Is an Event ID for a completed Domain Controller promotion logged on the PDC?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/11b18816-7db0-49e2-9a65-3de0e7a9645e/is-an-event-id-for-a-completed-domain-controller-promotion-logged-on-the-pdc?forum=winserverDS
Best regards,
Frank Shen

Audit logs for read operation on tables

I have a requirement of implementing audit logs for tables on read / select operation in addition to insert,update,delete operations. Is there any way to achieve this since triggers are present only for insert,update and delete ?
thanks in advance

Hi,
yes there are many ways you can audit the Source database according to your requirments. as you need to audit the select , insert etc you can audit in many ways
1) By implementing policies , (i.e) FGA , or statement policy on a given table or a given user.
2) you can also do the required task by implementing the alerts on specific conditions like select on a specifc table etc
you can use these utileties from AV console.
Regards.

Is there a way to include the sys.aud$ table in a full database dp export?

I am doing an export using the following parfile information:
userid=/
directory=datapump_nightly_export
dumpfile=test_expdp.dmp
logfile=test_expdp.log
full=y
content=all
However when I run this I do not see the sys.aud$ in the log file. I know I can do a seperate export to specifically get the sys.aud$ table but is there any way to include it in with my full export?
Thanks in advance for any suggestion.

here's more background infomation... I have some audits setup on my database for one of my users. Every quarter I have an automated job that runs that creates a usage/statics report for this person using data in aud$. at the end of the job I export the aud$ table and truncate it. However last quarter I found that there was a mistake in my report and my export did not run properly thus my audit data was gone. i also have full datapump exports that run daily but found that aud$ was not there. so that is why I thought I'd like to include sys.aud$ in the full datapump exports.
i understand why other sys tables would be left out of a full export but aud$ data cannot be reproduced so to me it makes sense to include it in a full export.
don't worry, we run our true backups using rman which is eventually how I got the aud$ data back by creating a copy of my database up until the time of the truncate. however this was quite time consuming.

Capture Audit log

Can any one tell me how to capture Audit log in sap without enabling it i,e. not through sm20

My concern was without enabling audit log through sm19, and display by SM21. How can i find user activity in SAP? i.e, at what time user login/logout from sap and entered which t-code/report of sap and executed which table of sap?
more over i would like to know all these details like...track user activity from SAP i.e., date, time, terminal name, ip address and transaction code, program name and database table along with these details:
a.     PC identity, which is fixed and unique for each users' pc.
b.     VPN login - external and internal ip address of connecting pc.
c.     Report on users connecting to multiple SAP idu2019s from the same pc.
d.     For watched users, need to watch every single record that they access.
e.     Capturing users accessed to which database table of SAP.
Edited by: Ravipawar1 on Feb 9, 2011 4:28 PM

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

Audit Log - Cancelled Messages

Hi all,
Can we see in AIF which user id has cancelled a particular message?
Thanks.
Kind Regards,
Brecht Bauwens

Hello Rafael,
We are on PI 7.0 Service Pack 15. We are also having the similar issue in our production system for the asynchronous messages delivered to the legacy database using JDBC Adapter. The status of the message in CC Monitoring is given as message successfully delivered, however the audit log is blank and has no information.
Could you please let me know, if the issue is resolved in your case by applying the above SAP Notes?
Thanks in advance!!
Thanks,
Manohar. Dubbaka

Query based on main table and audit table

Hi,
I had created auditing on some table. Values might not change and if they changed, it should be stored in audit table.
I want to get the values in the table a on real time basis, like dimentions in datawarehouse.
Trying to write a query based on table a and aud_a to get point-in-time or values at anytime in the past.
Something like
SELECT *
FROM a (table_name)
WHERE effective_from >= $DATE_TO_QUERY
AND effective_to < $DATE_TO_QUERY
How to get this kind of query .
Please help. ( Table structure for table a and audit table aud_a and trigger aud_tg_a given below)
Giving code as follows.
main table a
create table a
( val1 number,
val2 number,
update_by varchar2(30),
date_updated date);
creare auidt table aud_a
create table aud_a
( "AUDIT_SEQ" NUMBER,
"AUDIT_TRAN_ID" NUMBER,
"AUDIT_PROG_ID" VARCHAR2(30 BYTE),
"AUDIT_TERMINAL" VARCHAR2(16 BYTE),
"AUDIT_REASON" VARCHAR2(30 BYTE),
"AUDIT_ACTION" CHAR(1 BYTE),
"AUDIT_ACTION_BY" VARCHAR2(20 BYTE),
"AUDIT_ACTION_DT" DATE,
val1 number,
val2 number,
updated_by varchar2(30),
date_updated date);
trigger on table a to populate aud_a
CREATE OR REPLACE TRIGGER aud_tg_a AFTER
INSERT OR
DELETE OR
update on a
for each row
declare
v_time_now DATE;
v_terminal VARCHAR2(16);
v_tran_id NUMBER;
v_prog_id VARCHAR2(30);
V_reason VARCHAR2(30);
BEGIN
v_time_now := sysdate;
v_terminal := userenv('TERMINAL');
v_tran_id := 1;
v_prog_id := 'test';
v_reason := 'AUDIT';
IF inserting THEN
INSERT
INTO a
audit_seq,
AUDIT_tran_id,
AUDIT_prog_id,
AUDIT_reason,
AUDIT_terminal,
AUDIT_action_by,
AUDIT_action_dt,
AUDIT_action ,
val1,
val2,
updated_by,
date_updated
VALUES
s_audit_no.nextval,
v_tran_id,
v_prog_id,
v_reason,
v_terminal,
USER,
v_time_now,
'I' ,
:new.val1,
:new.val2,
:new.updated_by,
:new.date_updated
elsif deleting THEN
INSERT
INTO a
audit_seq,
AUDIT_tran_id,
AUDIT_prog_id,
AUDIT_reason,
AUDIT_terminal,
AUDIT_action_by,
AUDIT_action_dt,
AUDIT_action ,
us_agy_backed_id,
industry_subgroup,
comments,
updated_by,
date_updated
VALUES
s_audit_no.nextval,
v_tran_id,
v_prog_id,
v_reason,
v_terminal,
USER,
v_time_now,
'D' ,
:old.val1,
:old.val2,
:old.comments,
:old.updated_by,
:old.date_updated
elsif updating THEN
INSERT
INTO a
audit_seq,
AUDIT_tran_id,
AUDIT_prog_id,
AUDIT_reason,
AUDIT_terminal,
AUDIT_action_by,
AUDIT_action_dt,
AUDIT_action ,
us_agy_backed_id,
industry_subgroup,
comments,
updated_by,
date_updated
VALUES
s_audit_no.nextval,
v_tran_id,
v_prog_id,
v_reason,
v_terminal,
USER,
v_time_now,
'U' ,
:new.val1,
:new.val2,
:new.updated_by,
:new.date_updated
END IF;
END;
-------------------------

Hi hoek,
I am not able to use Oracle's audit functionality becuase I need to trap some changes in particular tables and then rebuild query if required.
Thanks for your suggestion though.
Regards,
Milind

Audit Log query

I am trying to figure out why a query of the OID audit logs is taking so long....
the search filter is:
(&(orcleventtime>=20070426)(orcleventtime<=20070427)(orcleventtype=User login))
it takes 97 seconds to return 1622 entries.
when i run a query with this filter....
(&(orcleventtime>=20070426)(orcleventtype=User login))
it takes 0.2 seconds
any ideas?

Purging an AUD$ table is good idea after taking the export....
Yeah...that could be better idea to audit those things that application skips...
I was just getting calls from finance and operations departments... complaining that their ERP applications were haning taking long time to execute day end procedures and in reports...around 20 to 30 minutes.... as I recalled that my last deployment on live was enabling of auditing as I executed noaudit all and noaudit select, update, delete, insert on erp, The user got their day end procedures executed and report in less than 1 minute...
Can anybody explain me....Does auditing degrades performance..?
Regards?

Consistency Problem In Audit Logs and Datafile

Hi,
We have audit logs of a transaction in audit files, however we do not see any changes in the table that the transaction affects.
We use point-in-time recovery and flashback feature to figure out the changes in the table . DML Audit Granularity is "ACCESS".
The transaction is java application transaction and we use hibernate.
How can this be possibble? Thank you.
Edited by: 867331 on 14.Ara.2012 07:05
Edited by: 867331 on 14.Ara.2012 07:07

Thanks for the reply,
jgarry wrote:
You've flashed or recovered back to a transaction in progress and the transaction was rolled back as part of recovery.We have duplicated the database(2 months early version of the database) from backup. We use Flashback Version Query to figure out the changes in the audited table.
Ex:
SELECT STATE FROM X
VERSIONS BETWEEN TIMESTAMP
TO_TIMESTAMP ('07-09-12 05:15:30','dd-mm-yy hh24:mi:ss')
AND TO_TIMESTAMP ('07-09-12 16:00:30','dd-mm-yy hh24:mi:ss')
where ID=1
We cannot find update transaction from this query. The "STATE" column is always null. However in audit xml file we see the "UPDATE" sql.
jgarry wrote:
Some code for a report or inquiry incorrectly does a select for update and doesn't actually update anything.There is no "select for update" statement.
Thank you.

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

Audit log AUD$ table and Query...

Similar Messages

Maybe you are looking for