Audit log output!!!!

Hi,
I have enabled object Auditing on our production Database.
Audit log destination i have given in OS level.(AUDIT_FILE_DEST='XXX')
In Audit log it is showing statement id only.
How can i know statement????
Below is the output of my database Audit log.
Thu Jun 26 11:48:10 2008
SESSIONID: "13194352" ENTRYID: "1" STATEMENT: "122" USERID: "SYSADM" ACTION: "103" RETURNCODE: "0" OBJ$CREATOR: "SYSADM" OBJ$
NAME: "PS_BUYER_TBL" SES$ACTIONS: "---------S------" SES$TID: "5682" OS$USERID: "fscmadm"
Thu Jun 26 11:49:33 2008
SESSIONID: "13194352" ENTRYID: "2" STATEMENT: "136" USERID: "SYSADM" ACTION: "103" RETURNCODE: "0" OBJ$CREATOR: "SYSADM" OBJ$
NAME: "PS_BUYER_TBL" SES$ACTIONS: "---------S------" SES$TID: "5682" OS$USERID: "fscmadm"
Thu Jun 26 12:59:35 2008
SESSIONID: "13194352" ENTRYID: "3" STATEMENT: "2941" USERID: "SYSADM" ACTION: "103" RETURNCODE: "0" OBJ$CREATOR: "SYSADM" OBJ
$NAME: "PS_BUYER_TBL" SES$ACTIONS: "---------S------" SES$TID: "5682" OS$USERID: "fscmadm"
*******************************************************************************************

Hi Saagar,
Thanks for your responce!!!
the doc which u post is for 10g
But in mycase my database is 8.1.7
& i have enabled object level auditing
In my audit logs i am not getting SQL statements (See above output)
can u please tell me how to find SQL statements.

Similar Messages

Unable to get Audit logs for Data Mining Model Oracle11g

Hi All, I followed all the steps given below 2 links but not getting any audit logs.
http://download.oracle.com/docs/cd/B28359_01/datamine.111/b28130/install_odm.htm#DMADM024
http://download.oracle.com/docs/cd/B28359_01/datamine.111/b28130/schemaobjs.htm#sthref233
Made sure the audit_trail is set to DB.
SQL cmds and its output shown below
SQL> AUDIT GRANT,AUDIT,COMMENT,RENAME,SELECT ON mining model NB_SH_Clas_sample;
Audit succeeded.
SQL> COMMENT ON MINING MODEL NB_SH_Clas_sample IS 'i am here';
COMMENT ON MINING MODEL NB_SH_Clas_sample IS 'i am here'
ERROR at line 1:
ORA-03113: end-of-file on communication channel
Process ID: 31648
Session ID: 135 Serial number: 114
SQL> quit
Please help me if i have left out any step
Thanks in Advance

Hi.
Please take a look at the other concurrent thread on model object auditing for more detailed information. If you have Oracle support, please file a TAR with Metalink (http://metalink.oracle.com).
Regards, Peter.

Mailbox audit log - Not searchable

Exchange 2010 SP2 RU7
I enabled audit on one mailbox using the Set-Mailbox cmdlet. Here is the audit-specific o/p from the mailbox,
AuditEnabled : True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditDelegate : {Move, MoveToDeletedItems, SoftDelete, HardDelete} AuditOwner : {Move, MoveToDeletedItems, SoftDelete, HardDelete}
I am trying to track who is deleting objects from the mailbox, so I tested whether auditing is actually logging anything by deleting three items at different times from the mailbox. The I run another cmdlet to test whether an audit folder is there and what
are it's contents,
PS C:\temp\ps> Get-MailboxFolderStatistics -Identity "MBX" | ? {$_.Name -eq "Audits" -and $_.FolderType -eq "Audits"} | Format-Table Identity, ItemsInFolder, FolderSize -AutoSize
Identity ItemsInFolder FolderSize
MBX\Audits 3 5.918 KB (6,060 bytes)
Sure enough there are 3 items in there meaning it's auditing those deletions. BUT when I try to search the audit logs using the below command, I get no results (YES I am using the -ShowDetails switch).
Search-MailboxAuditLog -Identity MBX -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate "2/1/2014" -EndDate "2/10/2014" | ft Operation, OperationResult, LogonUserDisplayName, ItemSubject, LastAccessed, -AutoSize
If there are results in the audit log, then why is the search-mailboxauditlog not presenting them even with the broadest search criteria? I have tried removing the start and end dates too but no luck.
Really frustrated with these half-baked features Microsoft puts into these products. Can someone help?

Hi,
In order to troubleshoot the issue more efficiently, I need to clarify some information.
1. Did the issue affect all users or only one specific user?
2. Have you tied to extract the result from ECP or using New-MailboxAuditLogSearch?
3. Is there any error message in the event log?
For this issue, could you please test again using this mailbox you mentioned above to check the result? I tested in my lab, search results are outputed after waiting for some time.
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Access request Audit log

Hi experts,
For all the access requests we are getting the complete audit trail and Even we will get whether Risk Analysis is scheduled in the Workflow.
But is there any possibility to get the output of Risk Analysis in the audit trail?
Please suggest.
Thanks,

Hi Sriram,
in standard solution what you can see in audit log is the information risk analysis during access request was executed, there is no standard way to see this information in audit log.
If you go for abap customization, please note this information is usualy very big and long and adding it to audit log my simply make audit log unclear...and very much complicated.
Hope this helps,
Filip

Runtime error for Audit Log reports

Hi,
I have activated Reports feature at Site Collection level and then tried to run custom report for Dashboard library under Audit Log Reports but I got Run Time error. I tried on my local machine and on server.
Can any body let me know how to resolve this issue to get custom report?
Any help would be appreciated.
BELOW IS THE ERROR MESSAHE:
Server Error in '/' Application
Runtime Error
Description: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed
by browsers running on the local server machine.
Details: To enable the details of this specific error message to be viewable on remote machines, please create a <customErrors> tag within a "web.config" configuration file located in the root directory of the current web application.
This <customErrors> tag should then have its "mode" attribute set to "Off".

<configuration>
<system.web>
<customErrors mode="Off"/>
</system.web>
</configuration>
Notes: The current error page you are seeing can be replaced by a custom error page by modifying the "defaultRedirect" attribute of the application's <customErrors> configuration tag to point to a custom error page URL.

<configuration>
<system.web>
<customErrors mode="RemoteOnly" defaultRedirect="mycustompage.htm"/>
</system.web>
</configuration>
AEDLA.

The audit log reporting is kind of tricky to work with...until you know what you're doing.
Some things to check: Do you have the Reporting feature enabled? Do you have auditing enabled on sites in this site collection? Have any events been triggered that would have written to the audit logs? Did you specify an output library
for the report? Will the report have any data?
Also, look at the SharePoint logs in C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS\ and let us know any "Unexpected" errors.
Bob Guidinger
Please remember to click "Propose As Answer" if a post solves your problem or "Vote As Helpful" if it was useful.

The format of Audit log file

We have a perl script to extract data from Audit log files(Oracle Database 10g Release 10.2.0.1.0) which have format as bellow.
Audit file /u03/oracle/admin/NIKKOU/adump/ora_5037.aud
Oracle Database 10g Release 10.2.0.1.0 - Production
ORACLE_HOME = /u01/app/oracle/product/10.2.0
System name:     Linux
Node name:     TOYDBSV01
Release:     2.6.9-34.ELsmp
Version:     #1 SMP Fri Feb 24 16:54:53 EST 2006
Machine:     i686
Instance name: NIKKOU
Redo thread mounted by this instance: 1
Oracle process number: 22
Unix process pid: 5037, image: oracleNIKKOU@TOYDBSV01
Sun Jul 27 03:06:34 2008
ACTION : 'CONNECT'
DATABASE USER: 'sys'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL:
STATUS: 0
After we update the db from Release 10.2.0.1.0 to Release 10.2.0.4.0, the format of Audit log file had been changed to something likes below.
Audit file /u03/oracle/admin/NIKKOU/adump/ora_1897.aud
Oracle Database 10g Release 10.2.0.4.0 - Production
ORACLE_HOME = /u01/app/oracle/product/10.2.0
System name:     Linux
Node name:     TOYDBSV01
Release:     2.6.9-34.ELsmp
Version:     #1 SMP Fri Feb 24 16:54:53 EST 2006
Machine:     i686
Instance name: NIKKOU
Redo thread mounted by this instance: 1
Oracle process number: 21
Unix process pid: 1897, image: oracle@TOYDBSV01
Tue Oct 14 10:30:29 2008
LENGTH : '135'
ACTION :[7] 'CONNECT'
DATABASE USER:[3] 'SYS'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[0] ''
CLIENT TERMINAL:[7] 'unknown'
STATUS:[1] '0'
Because we have to rewrite the perl script, could anyone tell us where we can find the manual to describe the format of the Audit log file.

Oracle publishes views of the audit trail data. You can find a list of the views for the 11.1 database here:
http://download.oracle.com/docs/cd/B28359_01/network.111/b28531/auditing.htm#BCGIICFE
The audit trail does not really change between patchsets as that would constitute underlying structure changes and right now, the developers are not allowed to change the underlying structure of tables in patchsets. But, we can change what may be displayed in a column from patchset to patchset. For example, we are getting ready to update the comment$text field to display more information like dblinks and program names.
I personally don't like overloading the comment$text field like that, but sometimes when you need the information, that is the only choice except to wait for the next major release :)
As for the output of the audit log files, those can change between patchsets because of bugs that were found and some changes to support Audit Vault. My apologies out there for anyone that is reading the audit files written to the OS directly, I would recommend using the views.
Hope that helps. Tammy

Set to Upload Audit Log Entries into particular Library Programatically

Hi,
We got a requirement where need to set the Library to which the Audit Log needs to store.
By default in OOB, we have option as Browse and Set the document Library for Auditing any Site/Web/List. But in SPAudit class we couldn't find any related Methods/Properties to which we can set where this Audit Log entry should need to happen.
Could anyone help us asap.
Dinesh Pulugundla, Microsoft Certified Technology Specialist.

I don't know if that functionality is available programatically. My guess is SharePoint uses SPAudit.GetItems() or the SPAuditQuery class to query the
events and outputs as a Excel (CSV) file to the library you specify.
You could try recreating this process in your code.
Jason Warren
Habanero Consulting Group
habaneroconsulting.com/Insights
@jaspnwarren

SharePoint 2013 audit log unexpected error

In one of my SharePoint 2013 site collection, when i try to save a audit log, i get unexpected error. It worked fine before last week and no any special setting has been applied before the issue appeared. The issue doesn't appear in other site collection.
i have tried to reproduce the issue with farm admin account and site collection admin, no success for all these accounts. However, i can see access denied error in the ULS log although i think the permission is not the problem. You may check the ULS log below.
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xC33B005
2jtj Assert
ShipAssert location: (0) condition: StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Unified Logging Service c91s
Monitorable Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D00B
2jtk High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D00B
2jtq High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
2jx8 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
5s03 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
5s02 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
2jw0 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.43 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Database ahjqp
High [Forced due to logging gap, cached @ 06/19/2014 10:48:07.68, Original Level: Verbose] SQL connection time: 0.064296296654057
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.43 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
General 8nca
Medium Application error when access /_layouts/15/CustomizeReport.aspx, Error=拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb) 在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing)
在 System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator) 在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.44 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Runtime tkau
Unexpected System.Runtime.InteropServices.COMException: 拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr
errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb) 在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing) 在
System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator) 在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.44 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
General ajlz0
High Getting Error Message for Exception System.Web.HttpUnhandledException (0x80004005): 引发类型为“System.Web.HttpUnhandledException”的异常。 ---> System.Runtime.InteropServices.COMException (0x80030005): 拒绝访问。 (异常来自 HRESULT:0x80030005
(STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)
在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing) 在 System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)
在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 在 System.Web.UI.Page.HandleError(Exception e) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 在 System.Web.UI.Page.ProcessRequest() 在 System.Web.UI.Page.ProcessRequest(HttpContext context)
在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() 在 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44

i have added the account to the local admin group of SQL Server and SharePoint Server. the issue remains. it is the system admin of the SQL server.
Logging Correlation Data
Medium
Name=Request (POST:https://xxx/_layouts/15/CustomizeReport.aspx?ReportId=df9e0f20-f356-4115-9286-ac6eecbc03ce&Category=Auditing)
Authentication Authorization
Medium
Non-OAuth request. IsAuthenticated=True, UserIdentityName=0#.w|tlw\farmadmin, ClaimsCount=28
Logging Correlation Data
Medium
Site=/
Information Rights Management
Medium
Information Rights Management (IRM): Requesting user is System account.
Files
High
UserAgent not available, file operations may not be optimized.    在 Microsoft.SharePoint.SPFileStreamManager.CreateCobaltStreamContainer(SPFileStreamStore spfs, ILockBytes ilb, Boolean copyOnFirstWrite, Boolean
disposeIlb)     在 Microsoft.SharePoint.SPFileStreamManager.SetInputLockBytes(SPFileInfo& fileInfo, SqlSession session, PrefetchResult prefetchResult)     在 Microsoft.SharePoint.CoordinatedStreamBuffer.SPCoordinatedStreamBufferFactory.CreateFromDocumentRowset(Guid
databaseId, SqlSession session, SPFileStreamManager spfstm, Object[] metadataRow, SPRowset contentRowset, SPDocumentBindRequest& dbreq, SPDocumentBindResults& dbres)     在 Microsoft.SharePoint.SPSqlClient.GetDocumentContentRow(Int32
rowOrd, Object ospFileStmMgr, SPDocumentBindRequest& dbreq, SPDocumentBindResults& dbres)     在 Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet,
String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean&
pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object& pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String&
pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel, UInt64& ppermMask, Object& pvarBuildDependencySet, UInt32& pdwNumBuildDependencies,
Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte
bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument,
Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object& pvarMetaData, Object&
pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel, UInt64& ppermMask, Object&
pvarBuildDependencySet, UInt32& pdwNumBuildDependencies, Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.Library.SPRequest.GetFileAndMetaInfo(String
bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean&
pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object&
pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel,
UInt64& ppermMask, Object& pvarBuildDependencySet, UInt32& pdwNumBuildDependencies, Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.SPWeb.GetWebPartPageContent(Uri
pageUrl, Int32 pageVersion, PageView requestedView, HttpContext context, Boolean forRender, Boolean includeHidden, Boolean mainFileRequest, Boolean fetchDependencyInformation, Boolean& ghostedPage, String& siteRoot, Guid& siteId, Int64& bytes,
Guid& docId, UInt32& docVersion, String& timeLastModified, Byte& level, Object& buildDependencySetData, UInt32& dependencyCount, Object& buildDependencies, SPWebPartCollectionInitialState& initialState, Object& oMultipleMeetingDoclibRootFolders,
String& redirectUrl, Boolean& ObjectIsList, Guid& listId)     在 Microsoft.SharePoint.ApplicationRuntime.SPRequestModuleData.FetchWebPartPageInformationForInit(HttpContext context, SPWeb spweb, Boolean mainFileRequest, String
path, Boolean impersonate, Boolean& isAppWeb, Boolean& fGhostedPage, Guid& docId, UInt32& docVersion, String& timeLastModified, SPFileLevel& spLevel, String& masterPageUrl, String& customMasterPageUrl, String& webUrl, String&
siteUrl, Guid& siteId, Object& buildDependencySetData, SPWebPartCollectionInitialState& initialState, String& siteRoot, String& redirectUrl, Object& oMultipleMeetingDoclibRootFolders, Boolean& objectIsList, Guid& listId, Int64&
bytes)     在 Microsoft.SharePoint.ApplicationRuntime.SPRequestModuleData.GetWebPartPageData(HttpContext context, String path, Boolean throwIfFileNotFound)     在 Microsoft.SharePoint.ApplicationRuntime.SPVirtualPathProvider.GetCacheKey(String
virtualPath)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultFromCacheInternal(VirtualPath virtualPath, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultInternal(VirtualPath
virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultWithNoAssert(HttpContext context, VirtualPath
virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResult(HttpContext context, VirtualPath virtualPath,
Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean ensureIsUpToDate)     在 System.Web.UI.MasterPage.CreateMaster(TemplateControl owner, HttpContext context, VirtualPath masterPageFile, IDictionary contentTemplateCollection)
在 System.Web.UI.Page.ApplyMasterPage()     在 System.Web.UI.Page.PerformPreInit()     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest()     在 System.Web.UI.Page.ProcessRequest(HttpContext context)
在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     在 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)     在 System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception
error)     在 System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb)     在 System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)
在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)     在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer,
IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)     在 System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)     在 System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr
pHandler, RequestNotificationStatus& notificationStatus)     在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
Files
Medium
Spent 0 ms to bind 29783 byte file stream
Monitoring
High
Leaving Monitored Scope (GetFileAndMetaInfo). 执行时间=17.6751425083646
Monitoring
High
Leaving Monitored Scope (GetWebPartPageContent). 执行时间=17.8435806939653
OpenXml
Medium
OfficePackageLibrary::OpenPackage(app=3, path=C:\Users\FarmAdmin\AppData\Local\Temp\tmpBFE2.tmp, fcm=3)
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:33.08, Original Level: Verbose] SQL connection time: 0.0727483919888626
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:35.00, Original Level: Verbose] SQL connection time: 0.07969118458531
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
0xC33B005
Assert
ShipAssert location: (0) condition:   StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
Unified Logging Service
Monitorable
Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xC33B005
Assert
ShipAssert location: (0) condition:   StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
Unified Logging Service
Monitorable
Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:36.86, Original Level: Verbose] SQL connection time: 0.0706353681551612
General
Medium
Application error when access /_layouts/15/CustomizeReport.aspx, Error=拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED))   在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo)     在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean
disposing)     在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()     在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Runtime
Unexpected
System.Runtime.InteropServices.COMException: 拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED))    在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean disposing)
在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()     在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
General
High
Getting Error Message for Exception System.Web.HttpUnhandledException (0x80004005): 引发类型为“System.Web.HttpUnhandledException”的异常。 ---> System.Runtime.InteropServices.COMException (0x80030005): 拒绝访问。 (异常来自 HRESULT:0x80030005
(STG_E_ACCESSDENIED))     在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)     在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset,
Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean disposing)     在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()
在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable
query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String
eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.HandleError(Exception e)     在 System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest()
在 System.Web.UI.Page.ProcessRequest(HttpContext context)     在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     在 System.Web.HttpApplication.ExecuteStep(IExecutionStep
step, Boolean& completedSynchronously)

Audit Log Report not display and error is "Report Contents No data"

Dear All,
i have reuired the audit log report but when i am click the Site Action->Site Setting->Audit log reports->Run a custom report-> select the day and option and click ok the i have received the error
Please help me please check below screen shot

Can you please confirm that you have configured events to audit?
Configure
audit settings for a site collection
Here is step by step how to configure audit setting.
http://anthony-verschraegen.blogspot.ca/2013/04/sharepoint-2013-configuring-audit.html
Amit

Issue with Audit Log report in SharePoint 2010

I have enabled REPORTING feature at site collection level and configured the site collection audit settings. I tried to generated Audit log reports, most of the time it keeps on processing as shown in fig.It
keeps on processing, never comes to report generated successful message. how to overcome this issue?

i'm facing same issue, even when i tried to generate report for limited limited period(5 days) for a particular event(ex: delete or restore items (or) edit items).
I think, the below reference may guide you solve your issue
http://sharepoint.stackexchange.com/questions/17151/how-often-should-the-auditing-log-be-cleared-to-not-affect-performance
Sekar - Our life is short, so help others to grow
Whenever you see a reply and if you think is helpful, click "Vote As Helpful"! And whenever
you see a reply being an answer to the question of the thread, click "Mark As Answer

Not able to generate "Audit Log Tampering report"

Hi,
I am not able to generate the Audit Log tampering report in version 8.0 of Sun Identity Manager. I am encountering the following message when I am trying to generate the report.
"Tamper-resistant logging is disabled. Unable to verify the integrity of the audit logs." I did not find any option to set the tamper-resistant logging feature in version 8.0 of Sun Idm.
In version 6 there is an option to set the tamper resistant audit log box by "Enabling tamper-resistant audit logs box" ( Please refer: http://docs.sun.com/source/819-4483/auditing.html)
The generated report (in version 6) did not show any data inspite of me deleting a row in the audit log.
I hope you can help me with this problem. Thanks in advance
Regards,
Sharon

1) It shouldnt matter, but try
destype=file (FILE small case)
2) In builder, in property pallette see if you have given any "initial value" for these parameters (especially desname, destype etc) ?
3) Do not give "batch=yes" in command line and try
Thanks
Ratheesh

Write to audit log from Axis Handler

Hi guys,
Using PI 7.11 SP 04 I have deployed the com.sap.aii.af.axisproviderlib.sda containing the libraries for Axis.
This is deployed fine and I can write my Handlers without trouble.
There is only 1 issue bugging me and that is the writing to the Adapter Audit Log. In SAP Note 1039369 FAQ XI Axis Adapter it is described how to write to the Audit log.
I can successfully write to the Channel monitor. But when I try to write to the Audit log data is still just written to the Channel monitor and not the audit log.
So what I have done is:
StatusAgent sa = (StatusAgent) getOption(Constants.MONITOR_AGENT_KEY);
Hashtable ht = getOptions();
ht.put("audit", Boolean.TRUE);
ht.put("pivoted", Boolean.TRUE);
sa.reportEvent(Status.OK, "This should be written to audit log but is written to channel monitor", ht);
sa.reportEvent(Status.ERROR, "This should also be written to audit log but is written to channel monitor", ht);
If i print the content of my hashtable in the channel monitor I can see that my entries are put into the table just fine. The 'audit' entry just seems to be completely ignored.
Anyone have and suggestions?
Regards,
Daniel

Hi Guys,
I need to know what JAR file i need to download for the following packages from SAP PI.
import com.sap.aii.axis.monitor.Status;
import com.sap.aii.axis.monitor.StatusAgent;
import com.sap.aii.axis.utils.Constants;
I am doing AXIS custom modules and i need to write to the PI 7.1 Audit Logs.
Thanks in advance.
Raj

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

Xorg freezes, video lags, high log output (linux,xorg-server,nvidia)

Hey,
It seems the up-to-date system doesn't work for my Laptop anymore. Wasn't too sure where to post this, as I couldn't test this anywhere else yet.
I experience extreme lags in Xorg (apparently due to high log output to Xorg.0.log as mentioned here: https://bbs.archlinux.org/viewtopic.php … 9#p1305939 ). These lags seem to be related to Xorg, the linux kernel and maybe something else I haven't found yet.
Concerning the hardware: Dell XPS 1340 with:
00:00.0 Host bridge: NVIDIA Corporation MCP79 Host Bridge (rev b1)
00:00.1 RAM memory: NVIDIA Corporation MCP79 Memory Controller (rev b1)
00:03.0 ISA bridge: NVIDIA Corporation MCP79 LPC Bridge (rev b2)
00:03.1 RAM memory: NVIDIA Corporation MCP79 Memory Controller (rev b1)
00:03.2 SMBus: NVIDIA Corporation MCP79 SMBus (rev b1)
00:03.3 RAM memory: NVIDIA Corporation MCP79 Memory Controller (rev b1)
00:03.5 Co-processor: NVIDIA Corporation MCP79 Co-processor (rev b1)
00:04.0 USB controller: NVIDIA Corporation MCP79 OHCI USB 1.1 Controller (rev b1)
00:04.1 USB controller: NVIDIA Corporation MCP79 EHCI USB 2.0 Controller (rev b1)
00:06.0 USB controller: NVIDIA Corporation MCP79 OHCI USB 1.1 Controller (rev b1)
00:06.1 USB controller: NVIDIA Corporation MCP79 EHCI USB 2.0 Controller (rev b1)
00:08.0 Audio device: NVIDIA Corporation MCP79 High Definition Audio (rev b1)
00:09.0 PCI bridge: NVIDIA Corporation MCP79 PCI Bridge (rev b1)
00:0a.0 Ethernet controller: NVIDIA Corporation MCP79 Ethernet (rev b1)
00:0b.0 SATA controller: NVIDIA Corporation MCP79 AHCI Controller (rev b1)
00:0c.0 PCI bridge: NVIDIA Corporation MCP79 PCI Express Bridge (rev b1)
00:10.0 PCI bridge: NVIDIA Corporation MCP79 PCI Express Bridge (rev b1)
00:15.0 PCI bridge: NVIDIA Corporation MCP79 PCI Express Bridge (rev b1)
00:16.0 PCI bridge: NVIDIA Corporation MCP79 PCI Express Bridge (rev b1)
00:17.0 PCI bridge: NVIDIA Corporation MCP79 PCI Express Bridge (rev b1)
00:18.0 PCI bridge: NVIDIA Corporation MCP79 PCI Express Bridge (rev b1)
01:07.0 FireWire (IEEE 1394): Ricoh Co Ltd R5C832 IEEE 1394 Controller (rev 05)
01:07.1 SD Host controller: Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter (rev 22)
01:07.2 System peripheral: Ricoh Co Ltd R5C592 Memory Stick Bus Host Adapter (rev 12)
01:07.3 System peripheral: Ricoh Co Ltd xD-Picture Card Controller (rev 12)
02:00.0 VGA compatible controller: NVIDIA Corporation G98M [GeForce 9200M GS] (rev a1)
03:00.0 VGA compatible controller: NVIDIA Corporation C79 [GeForce 9400M G] (rev b1)
06:00.0 Network controller: Qualcomm Atheros AR928X Wireless Network Adapter (PCI-Express) (rev 01)
I tested the up-to-date nvidia and nouveau drivers, to no avail. They both spam Xorg.0.log as soon as I watch a video, move a window or do something similiar "hi-res" in Gnome, leading to lags in all applications and X itself until it dies from high CPU usage + high chip temperature.
So I started downgrading my system.
I tested linux 3.9.9 but that didn't do the trick.
Currently I'm on linux 3.8.8-2, nvidia 313.30-5 and xorg-server 1.13.3-1, xf86-input-evdev 2.7.3-2 and xf86-input-wacom 0.20.0-1. This seems to be stable so far, the extreme X log output persists though, as soon as an external monitor is plugged in:
[ 234.963] (II) NVIDIA(GPU-0): Display (DELL2407WFPHC (DFP-1)) does not support NVIDIA 3D
[ 234.963] (II) NVIDIA(GPU-0): Vision stereo.
[ 234.963] (**) NVIDIA(0): Using HorizSync/VertRefresh ranges from the EDID for display
[ 234.963] (**) NVIDIA(0): device DELL2407WFPHC (DFP-1) (Using EDID frequencies has
[ 234.963] (**) NVIDIA(0): been enabled on all display devices.)
I tried nvidia drivers with and without my xorg.conf.d snippets, but that didn't change anything.
I'm kinda clueless... which package is the odd one out? All of them? At this point I wouldn't even know where to file a bug report.
I've been away for a couple of months and didn't upgrade the system too often in between, but this behavior is really odd.
Any ideas/ help would be highly appreciated!

Okay... I can definitely revise my statement about the Xorg.0.log. It has been the same since yesterday... so the spamming is gone!
I'd really like to find out if this is a linux kernel or a direct Xorg problem (of version 1.14 and above).

Audit log output!!!!

Similar Messages

Maybe you are looking for