Audit Log query

I am trying to figure out why a query of the OID audit logs is taking so long....
the search filter is:
(&(orcleventtime>=20070426)(orcleventtime<=20070427)(orcleventtype=User login))
it takes 97 seconds to return 1622 entries.
when i run a query with this filter....
(&(orcleventtime>=20070426)(orcleventtype=User login))
it takes 0.2 seconds
any ideas?

Purging an AUD$ table is good idea after taking the export....
Yeah...that could be better idea to audit those things that application skips...
I was just getting calls from finance and operations departments... complaining that their ERP applications were haning taking long time to execute day end procedures and in reports...around 20 to 30 minutes.... as I recalled that my last deployment on live was enabling of auditing as I executed noaudit all and noaudit select, update, delete, insert on erp, The user got their day end procedures executed and report in less than 1 minute...
Can anybody explain me....Does auditing degrades performance..?
Regards?

Similar Messages

Security Audit Log / Logging of downloads from query results?

Hi everybody,
our data protection team has raised the requirement to log all data downloads from our BW system. As far as I know, it is possible to log downloads in SAP GUI using Security Audit Log, but does this also cover "Export to Excel" functionality of query results executed in the portal? And what about execution of queries with BEx Analyzer? I doubt, if that tool would log this. Are there any other tools available to cover that requirement?
Any comment and idea is welcome. Thanks in advance!
Regards,
Carsten

If restricted to ALV I think it can be done, but even there... if the user executes it in background and mails or prints the spool request then the cat is out of the box...
Moral of the story: Do not grant access if the user should not be able to see the data (regardless where they log on from).
That you cannot monitor / log all (mass) download events is however a bit unfortunate, however once the data is outside of the system for those whom you do trust then you anyway need to train them not to park sensitive files on project or public file servers.
IMO the main problem here is front-end computing tools (like Excel, etc) which the users feel more confortable with to analyze data than the server side analytics tools (e.g. in the ALV task bars, or even the BOBJ Dashboards which are very "user-sentric").
In German it is known as "Bauern mentalität" (farmer mentality) which generally resides at the application surphase layer in the greater scheme of things:
-> You do not eat anything you have not slaughtered yourself...
Specifically regarding tokenization, you can consider not displaying the data in the portal. If the user wants to display these fields they have to navigate in their own context into the backend system to retrieve the token and then only display individual values.
--> A download of a list via the portal or BEX excludes these fields which the user can access, but not mass download.
I think this is possible, but it will be a challenge depending on whether the fields support tockenization. Credit Card numbers as mentioned my Martin is fairly vanilla and already used.
Custom fields&types, insufficiently critical elements and older programs will be a bigger challenge.
Please provide more details, as the generic answers are not well take care of IMO. If you cannot provide mre details, then SDN discussions speculating on answers is not efficient either...
Cheers,
Julius

SharePoint 2013 audit log unexpected error

In one of my SharePoint 2013 site collection, when i try to save a audit log, i get unexpected error. It worked fine before last week and no any special setting has been applied before the issue appeared. The issue doesn't appear in other site collection.
i have tried to reproduce the issue with farm admin account and site collection admin, no success for all these accounts. However, i can see access denied error in the ULS log although i think the permission is not the problem. You may check the ULS log below.
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xC33B005
2jtj Assert
ShipAssert location: (0) condition: StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Unified Logging Service c91s
Monitorable Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D00B
2jtk High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D00B
2jtq High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
2jx8 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
5s03 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
5s02 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
2jw0 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.43 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Database ahjqp
High [Forced due to logging gap, cached @ 06/19/2014 10:48:07.68, Original Level: Verbose] SQL connection time: 0.064296296654057
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.43 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
General 8nca
Medium Application error when access /_layouts/15/CustomizeReport.aspx, Error=拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb) 在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing)
在 System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator) 在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.44 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Runtime tkau
Unexpected System.Runtime.InteropServices.COMException: 拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr
errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb) 在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing) 在
System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator) 在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.44 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
General ajlz0
High Getting Error Message for Exception System.Web.HttpUnhandledException (0x80004005): 引发类型为“System.Web.HttpUnhandledException”的异常。 ---> System.Runtime.InteropServices.COMException (0x80030005): 拒绝访问。 (异常来自 HRESULT:0x80030005
(STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)
在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing) 在 System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)
在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 在 System.Web.UI.Page.HandleError(Exception e) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 在 System.Web.UI.Page.ProcessRequest() 在 System.Web.UI.Page.ProcessRequest(HttpContext context)
在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() 在 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44

i have added the account to the local admin group of SQL Server and SharePoint Server. the issue remains. it is the system admin of the SQL server.
Logging Correlation Data
Medium
Name=Request (POST:https://xxx/_layouts/15/CustomizeReport.aspx?ReportId=df9e0f20-f356-4115-9286-ac6eecbc03ce&Category=Auditing)
Authentication Authorization
Medium
Non-OAuth request. IsAuthenticated=True, UserIdentityName=0#.w|tlw\farmadmin, ClaimsCount=28
Logging Correlation Data
Medium
Site=/
Information Rights Management
Medium
Information Rights Management (IRM): Requesting user is System account.
Files
High
UserAgent not available, file operations may not be optimized.    在 Microsoft.SharePoint.SPFileStreamManager.CreateCobaltStreamContainer(SPFileStreamStore spfs, ILockBytes ilb, Boolean copyOnFirstWrite, Boolean
disposeIlb)     在 Microsoft.SharePoint.SPFileStreamManager.SetInputLockBytes(SPFileInfo& fileInfo, SqlSession session, PrefetchResult prefetchResult)     在 Microsoft.SharePoint.CoordinatedStreamBuffer.SPCoordinatedStreamBufferFactory.CreateFromDocumentRowset(Guid
databaseId, SqlSession session, SPFileStreamManager spfstm, Object[] metadataRow, SPRowset contentRowset, SPDocumentBindRequest& dbreq, SPDocumentBindResults& dbres)     在 Microsoft.SharePoint.SPSqlClient.GetDocumentContentRow(Int32
rowOrd, Object ospFileStmMgr, SPDocumentBindRequest& dbreq, SPDocumentBindResults& dbres)     在 Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet,
String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean&
pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object& pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String&
pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel, UInt64& ppermMask, Object& pvarBuildDependencySet, UInt32& pdwNumBuildDependencies,
Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte
bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument,
Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object& pvarMetaData, Object&
pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel, UInt64& ppermMask, Object&
pvarBuildDependencySet, UInt32& pdwNumBuildDependencies, Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.Library.SPRequest.GetFileAndMetaInfo(String
bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean&
pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object&
pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel,
UInt64& ppermMask, Object& pvarBuildDependencySet, UInt32& pdwNumBuildDependencies, Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.SPWeb.GetWebPartPageContent(Uri
pageUrl, Int32 pageVersion, PageView requestedView, HttpContext context, Boolean forRender, Boolean includeHidden, Boolean mainFileRequest, Boolean fetchDependencyInformation, Boolean& ghostedPage, String& siteRoot, Guid& siteId, Int64& bytes,
Guid& docId, UInt32& docVersion, String& timeLastModified, Byte& level, Object& buildDependencySetData, UInt32& dependencyCount, Object& buildDependencies, SPWebPartCollectionInitialState& initialState, Object& oMultipleMeetingDoclibRootFolders,
String& redirectUrl, Boolean& ObjectIsList, Guid& listId)     在 Microsoft.SharePoint.ApplicationRuntime.SPRequestModuleData.FetchWebPartPageInformationForInit(HttpContext context, SPWeb spweb, Boolean mainFileRequest, String
path, Boolean impersonate, Boolean& isAppWeb, Boolean& fGhostedPage, Guid& docId, UInt32& docVersion, String& timeLastModified, SPFileLevel& spLevel, String& masterPageUrl, String& customMasterPageUrl, String& webUrl, String&
siteUrl, Guid& siteId, Object& buildDependencySetData, SPWebPartCollectionInitialState& initialState, String& siteRoot, String& redirectUrl, Object& oMultipleMeetingDoclibRootFolders, Boolean& objectIsList, Guid& listId, Int64&
bytes)     在 Microsoft.SharePoint.ApplicationRuntime.SPRequestModuleData.GetWebPartPageData(HttpContext context, String path, Boolean throwIfFileNotFound)     在 Microsoft.SharePoint.ApplicationRuntime.SPVirtualPathProvider.GetCacheKey(String
virtualPath)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultFromCacheInternal(VirtualPath virtualPath, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultInternal(VirtualPath
virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultWithNoAssert(HttpContext context, VirtualPath
virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResult(HttpContext context, VirtualPath virtualPath,
Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean ensureIsUpToDate)     在 System.Web.UI.MasterPage.CreateMaster(TemplateControl owner, HttpContext context, VirtualPath masterPageFile, IDictionary contentTemplateCollection)
在 System.Web.UI.Page.ApplyMasterPage()     在 System.Web.UI.Page.PerformPreInit()     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest()     在 System.Web.UI.Page.ProcessRequest(HttpContext context)
在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     在 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)     在 System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception
error)     在 System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb)     在 System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)
在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)     在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer,
IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)     在 System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)     在 System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr
pHandler, RequestNotificationStatus& notificationStatus)     在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
Files
Medium
Spent 0 ms to bind 29783 byte file stream
Monitoring
High
Leaving Monitored Scope (GetFileAndMetaInfo). 执行时间=17.6751425083646
Monitoring
High
Leaving Monitored Scope (GetWebPartPageContent). 执行时间=17.8435806939653
OpenXml
Medium
OfficePackageLibrary::OpenPackage(app=3, path=C:\Users\FarmAdmin\AppData\Local\Temp\tmpBFE2.tmp, fcm=3)
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:33.08, Original Level: Verbose] SQL connection time: 0.0727483919888626
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:35.00, Original Level: Verbose] SQL connection time: 0.07969118458531
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
0xC33B005
Assert
ShipAssert location: (0) condition:   StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
Unified Logging Service
Monitorable
Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xC33B005
Assert
ShipAssert location: (0) condition:   StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
Unified Logging Service
Monitorable
Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:36.86, Original Level: Verbose] SQL connection time: 0.0706353681551612
General
Medium
Application error when access /_layouts/15/CustomizeReport.aspx, Error=拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED))   在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo)     在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean
disposing)     在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()     在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Runtime
Unexpected
System.Runtime.InteropServices.COMException: 拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED))    在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean disposing)
在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()     在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
General
High
Getting Error Message for Exception System.Web.HttpUnhandledException (0x80004005): 引发类型为“System.Web.HttpUnhandledException”的异常。 ---> System.Runtime.InteropServices.COMException (0x80030005): 拒绝访问。 (异常来自 HRESULT:0x80030005
(STG_E_ACCESSDENIED))     在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)     在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset,
Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean disposing)     在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()
在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable
query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String
eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.HandleError(Exception e)     在 System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest()
在 System.Web.UI.Page.ProcessRequest(HttpContext context)     在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     在 System.Web.HttpApplication.ExecuteStep(IExecutionStep
step, Boolean& completedSynchronously)

Consistency Problem In Audit Logs and Datafile

Hi,
We have audit logs of a transaction in audit files, however we do not see any changes in the table that the transaction affects.
We use point-in-time recovery and flashback feature to figure out the changes in the table . DML Audit Granularity is "ACCESS".
The transaction is java application transaction and we use hibernate.
How can this be possibble? Thank you.
Edited by: 867331 on 14.Ara.2012 07:05
Edited by: 867331 on 14.Ara.2012 07:07

Thanks for the reply,
jgarry wrote:
You've flashed or recovered back to a transaction in progress and the transaction was rolled back as part of recovery.We have duplicated the database(2 months early version of the database) from backup. We use Flashback Version Query to figure out the changes in the audited table.
Ex:
SELECT STATE FROM X
VERSIONS BETWEEN TIMESTAMP
TO_TIMESTAMP ('07-09-12 05:15:30','dd-mm-yy hh24:mi:ss')
AND TO_TIMESTAMP ('07-09-12 16:00:30','dd-mm-yy hh24:mi:ss')
where ID=1
We cannot find update transaction from this query. The "STATE" column is always null. However in audit xml file we see the "UPDATE" sql.
jgarry wrote:
Some code for a report or inquiry incorrectly does a select for update and doesn't actually update anything.There is no "select for update" statement.
Thank you.

Mailbox Audit Log

Can we backup mailbox audit log? These logs are stored in the recovery folder in each mailbox. Normally it should be backup with mailbox. How can restore and query these logs from after their audit age limit has expired?
Thanks.
Irfan
Irfan Goolab SALES ENGINEER (Microsoft UC) MCP, MCSA, MCTS, MCITP, MCT

Hi Irfan,
Base on my knowledge, you can refer to the following methods to backup audit log:
1. Export mailbox audit logs:
https://technet.microsoft.com/en-us/library/jj150552(v=exchg.150).aspx
2. Audit logs can be found in the eventviewer under MSExchangeManagement, you can save it, as below:
Best regards,
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Niko Cheng
TechNet Community Support

ODSI 10Gr3 audit logs common/time question

Hi
With ODSI10GR3, We are investigating delays in processing of some DB2 Inserts
Inserst occur daily but th eproblem happens maybe once in a week
A review of the audit log during teh problem occurance shows the following
Comon/time is taking 33 seconds
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }
with compile time being ~ 14 sec and insert time being ~ 4 seconds
Is it possible that things such as full gc ooccuring can impact this time?
We increased tx timeout to 120 seconds to avoid the timeout but would like to investigate further on this.
Thanks Much for any info
Best
####<Mar 1, 2010 10:22:09 AM PST> <Info> <ODSI> <qa-sc-eibapp02.corp.test.com> <ds_ms2> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <service.uateibsads> <> <> <1267467729490> <BEA-000000> <ClientDataspace> <DSPAuditEvent timestamp: Mon Mar 01 10:21:36 PST 2010 severity: FAILURE id: ClientDataspace:48:Mon Mar 01 10:21:36 PST 2010 {
common/application {
user: service.uateibsads
name: ClientDataspace
eventkind: update
server: ds_ms2
query/performance {
compiletime: 14869
update/relational {
source: CBS_DB2_DS
sql: INSERT INTO "S109935E"."C@CR538"."C@CUNEW01" ("C@STATUS", "C@SEQNBR", "CUBK", "CUNBR", "CUSTAT",
"CUALT", "CUNA1", "CUNA2", "CUNA3", "CUNA4", "CUNA5", "CUNA6", "CUZIP", "CUZIP2", "CUZIP3",
"CUZIP4", "CUSHRT", "CUSSNR@", "CUSSTY", "CUCLPH", "CUHMPH", "CUBUPH", "CUPOFF", "CUSOFF",
"CUPOF1", "CUPOF2", "CUOPDT", "CUTYPE", "CUTYP", "CUSIC", "CUSEX", "CURACE", "CUOWN", "CUYREM",
"CUINC", "CUSRIN", "CUBDTE", "CUDEP", "CUCTC", "CUCTCT", "CUCIRA", "CUMNBR", "CUNTID", "CUUSR1",
"CUCLNK", "CUUSR3", "CUCDCH", "CUCDCN", "CUCDCD", "CUCMCH", "CUCMNR", "CUCMCD", "CUCVSH",
"CUCVCN", "CUCVCD", "CUCATH", "CUCATN", "CUCATD", "CUCLNG", "CUCCCD", "CULGLR", "CUCWHP",
"CUCPSP", "CUCTXN", "CUCPRF", "CUSHKY", "CUITLD", "CUPSTL", "CUACOM", "CUBRCH", "CUMIDT@",
"CUMRTS", "CUMAIL", "CUSOLI", "CUSOCI", "CUCPNA", "CUBPNA", "CUPERS", "CUSALU", "CUFAX",
"CUTELX", "CUTXAN", "CUDOCF", "CUDCDT", "CUTINU", "CUTADT@", "CUWPRT", "CUCECD", "CUCELM",
"CUEXTF", "CUMTND", "CUCNCD", "CUMARK", "CUEMPL", "CUINQ", "CUMNT", "CUCENS", "CUCODT", "CUDEDT",
"CUACCD", "CUBYR1", "CUBYR2", "CUPREF", "CUJBDT", "CUJDDT", "CUEMA1", "CUEMA2", "CUOPT",
"CUOPTD", "CUSPFG", "CUOENTTYP", "CUCENTTYP", "CUAMDT", "CUESDT", "CUENA1", "CUENA2", "CUENA3",
"CUENA4", "CUENA5", "CUENA6", "CUEPST", "CUEZIP", "CUEZIS", "CUEZP3", "CUEZP4", "CUAAPL",
"CUAAKY", "CUAREC", "CUASTA", "CUANA1", "CUANA2", "CUANA3", "CUANA4", "CUANA5", "CUANA6",
"CUAZP1", "CUAZP2", "CUAZP3", "CUAZP4", "CUAPSD", "CUASTR", "CUASTP", "CUASTS", "CUAFLG",
"CUARFG", "CUCLS", "CURISK", "CURDT1", "CURSK2", "CURDT2", "CUCRLN", "CUCRDT", "CUCRFR",
"CUCRND", "CUCRPR", "CUFSDT", "CUFSFR", "CUFSND", "CUSALE", "CUCSTS", "CUNETI", "CUPRJI",
"CUASST", "CUCURA", "CUCASH", "CUACCR", "CUMKTS", "CUREAL", "CULIFE", "CUINVN", "CUFIXA",
"CULIAB", "CUCURL", "CULTRM", "CUNETW", "CUDIRL", "CUINDL", "CUDIRT", "CUINDT", "CUREDB",
"CULCRO", "CUOTHA", "CUOTHL", "CU5WHP", "CUIWHY", "CUWHEX", "CUFILL", "CUREC1", "CUSTAD",
"CUFRN1", "CUCHIB", "CUCHID", "CUCLOB", "CUCLOD", "CUCCDD", "CUCDD1", "CUCDD2", "CUCHD1",
"CUCHD2", "CUCHP1", "CUCHP2", "CUCHP3", "CUCHP4", "CUCOL1", "CUCOL2", "CUCOL3", "CUCOL4",
"CUCCDT", "CUCCYD", "CUCTYD", "CUCIDB", "CUCDIR", "CUCIND", "CUCSEC", "CUCUNS", "CUCILD",
"CUCOPN", "CUCTOD", "CUCNON", "CUCHGO", "CUCRNB", "CUCQAG", "CUCQHU", "CUCQHI", "CUCQLO",
"CUCQDD", "CUCQDT", "CUDPD1", "CUDPD2", "CUDPD3", "CUDPDP", "CUDPD", "CUIPD", "CUUPD", "CUCAGY",
"CUCIAM", "CUCIAY", "CUCPAM", "CUCPAY", "CUCLTC", "CUCLSO", "CUUCMO", "CULCCA", "CUDRSD",
"CUFACS", "CUINDS", "CUIPDS", "CUSECS", "CUUNSS", "CUDPDS", "CUUCMS", "CUBDIR", "CUBCMO",
"CUTHR1", "CUTHR2", "CUTHR3", "CUTHR4", "CUTHR5", "CUFIV1", "CUFIV2", "CUFIV3", "CUFIV4",
"CUFIV5", "CUTEN1", "CUTEN2", "CUTEN3", "CUTEN4", "CUTEN5", "CUTWN1", "CUTWN2", "CUTWN3",
"CUTWN4", "CUTWN5", "CUTHI1", "CUTHI2", "CUTHI3", "CUTHI4", "CUTHI5", "CUSEV1@", "CUSEV2",
"CUSEV3", "CUSEV4", "CUSEV5")
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
rowsmodified: 1
time: 3655
common/application {
exception: Transaction timed out after 29 seconds
BEA1-000021E917F59C34B15A
update/service {
procedure: InsertNewCIF
arity: 1
dataservice: ld:CoreBankingSystem/LogicalServices/CreateNewCIF.ds
script: declare namespace ns0="ld:CoreBankingSystem/LogicalServices/CreateNewCIF";
declare namespace ns1="http://www.test.com/schemas/client/cbs/logical";
declare variable $__fparam0 as element(ns1:NewCIF)* external;
{ return value ns0:InsertNewCIF($__fparam0); }
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }

1) Is it possible that there is a database lock preventing the insert from being committed?
2) What does the audit look like for a successful update?
3) Notice that the "compile time" is non-zero. This indicates that the plan was not cached. Likely because it is the first time this was executed after the server was started. So not only do you have the extra query compilation time, there would also be time for loading classes and other initialization. (but 12 seconds of loading an initialization seems like a lot). Given that increasing the tx time to 120 seconds solves the problem (it does solve the problem, doesn't it?) I would say that this is the issue.
4) Given that you just started the server (right? see (3)), it's not likely this is due to GC. But you could enable gc verbose to see.

How to extract audit log data from every document library in site collection using powershell?

Hi All,
I have n number of document library in one site collection,
My query is- How to extract audit log data from every document library in a site collection using powershell?
Please give solution as soon as possible?

Hi inguru,
For SharePoint audit log data, These data combine together in site collection. So there is no easy way to extract audit log data for document library.
As a workaround, you can export the site collection audit log data to a CSV file using PowerShell Command, then you can filter the document library audit log data in Excel.
More information:
SharePoint 2007 \ 2010 – PowerShell script to get SharePoint audit information:
http://sharepointhivehints.wordpress.com/2014/04/30/sharepoint-2007-2010-powershell-script-to-get-sharepoint-audit-information/
Best Regards
Zhengyu Guo
TechNet Community Support

SGD 4.6 audit logging question

When using audit logging and filters, how often is a new log file automatically created? I'm interested in preserving the audit data and need to know when the file gets recreated.
Thanks.

By default, the logs are archived once a week via a crontab entry (Sunday, 0300, by default) - this option is set at install time, can be changed by running tarantella setup, or you can alter the crontab entry directly.
See "7.2.3.6 Automatic Log Archives" in the admin guide - http://docs.oracle.com/cd/E26362_01/E26354/html/sgd-installation.html#sgd-installation-full-restore and
http://docs.oracle.com/cd/E26362_01/E26354/html/tta-archive.html for a description of the archive command.
The archive command closes out the current log files, and compresses/summarizes them, and stores them in a numbered sub-directory under the "logs" directory, and opens news ones. Once closed out, you can no longer "query" the logfiles from the command line. Note that there are a limited number of archives maintained - 7 sets, I believe, is the default.
Have a look at the "archive" command under .../bin/scripts to see how it works.

Set to Upload Audit Log Entries into particular Library Programatically

Hi,
We got a requirement where need to set the Library to which the Audit Log needs to store.
By default in OOB, we have option as Browse and Set the document Library for Auditing any Site/Web/List. But in SPAudit class we couldn't find any related Methods/Properties to which we can set where this Audit Log entry should need to happen.
Could anyone help us asap.
Dinesh Pulugundla, Microsoft Certified Technology Specialist.

I don't know if that functionality is available programatically. My guess is SharePoint uses SPAudit.GetItems() or the SPAuditQuery class to query the
events and outputs as a Excel (CSV) file to the library you specify.
You could try recreating this process in your code.
Jason Warren
Habanero Consulting Group
habaneroconsulting.com/Insights
@jaspnwarren

CMD=Ping&log query is taking long time-taken when checked in IIS logs.... Exchange 2010 SP3..

Query regarding the ActiveSync and parameter time-taken from ActiveSync IIS logs.
Here what I see for from the logs.
[email protected] 45.101.90.185 Apple-iPad2C3/1202.410 200 0 0 1501129
443 [email protected] 45.101.90.185 Apple-iPad2C3/1202.410 200
0 0 22105
443 [email protected] 45.101.90.185 Apple-iPad2C3/1202.410 200
0 0 452
443 [email protected] 45.101.90.185 Apple-iPad2C3/1202.410 200
0 0 936
443 [email protected] 45.101.90.185 Apple-iPad2C3/1202.410 200
0 0 656238
In the above log, highlighted are the time-taken and I just want to check what is the ideal time-taken value, some value above should be causing some problem, like the one of the top 1501129 ?
?AND I see its for POST event and CMD=Ping&log query.......
We have Mobile Iron in the environment and we are seeing few timeout errors on MobileIron server and for users intermittently. They usually see below error... However we don't see any end users issues, but just want to get rid of below error. MobileIron guys
are pointing it to time-taken value which is high intermittently.
IOException connection to server [email protected] -- java.io.IOException:
awaitUninterruptibly was stopped by timeout
@BALA

Hi,
To understand more about the issue, I’d like to confirm the following information:
1. What’s your Exchange 2010 version?
http://support.microsoft.com/kb/2536517/en-us
2. Do you install other software, like SQL, on the same Exchange Server?
3. Change another admin account to access EMS.
Thanks,
Angela Shi
TechNet Community Support

Audit Log Report not display and error is "Report Contents No data"

Dear All,
i have reuired the audit log report but when i am click the Site Action->Site Setting->Audit log reports->Run a custom report-> select the day and option and click ok the i have received the error
Please help me please check below screen shot

Can you please confirm that you have configured events to audit?
Configure
audit settings for a site collection
Here is step by step how to configure audit setting.
http://anthony-verschraegen.blogspot.ca/2013/04/sharepoint-2013-configuring-audit.html
Amit

Issue with Audit Log report in SharePoint 2010

I have enabled REPORTING feature at site collection level and configured the site collection audit settings. I tried to generated Audit log reports, most of the time it keeps on processing as shown in fig.It
keeps on processing, never comes to report generated successful message. how to overcome this issue?

i'm facing same issue, even when i tried to generate report for limited limited period(5 days) for a particular event(ex: delete or restore items (or) edit items).
I think, the below reference may guide you solve your issue
http://sharepoint.stackexchange.com/questions/17151/how-often-should-the-auditing-log-be-cleared-to-not-affect-performance
Sekar - Our life is short, so help others to grow
Whenever you see a reply and if you think is helpful, click "Vote As Helpful"! And whenever
you see a reply being an answer to the question of the thread, click "Mark As Answer

Not able to generate "Audit Log Tampering report"

Hi,
I am not able to generate the Audit Log tampering report in version 8.0 of Sun Identity Manager. I am encountering the following message when I am trying to generate the report.
"Tamper-resistant logging is disabled. Unable to verify the integrity of the audit logs." I did not find any option to set the tamper-resistant logging feature in version 8.0 of Sun Idm.
In version 6 there is an option to set the tamper resistant audit log box by "Enabling tamper-resistant audit logs box" ( Please refer: http://docs.sun.com/source/819-4483/auditing.html)
The generated report (in version 6) did not show any data inspite of me deleting a row in the audit log.
I hope you can help me with this problem. Thanks in advance
Regards,
Sharon

1) It shouldnt matter, but try
destype=file (FILE small case)
2) In builder, in property pallette see if you have given any "initial value" for these parameters (especially desname, destype etc) ?
3) Do not give "batch=yes" in command line and try
Thanks
Ratheesh

Write to audit log from Axis Handler

Hi guys,
Using PI 7.11 SP 04 I have deployed the com.sap.aii.af.axisproviderlib.sda containing the libraries for Axis.
This is deployed fine and I can write my Handlers without trouble.
There is only 1 issue bugging me and that is the writing to the Adapter Audit Log. In SAP Note 1039369 FAQ XI Axis Adapter it is described how to write to the Audit log.
I can successfully write to the Channel monitor. But when I try to write to the Audit log data is still just written to the Channel monitor and not the audit log.
So what I have done is:
StatusAgent sa = (StatusAgent) getOption(Constants.MONITOR_AGENT_KEY);
Hashtable ht = getOptions();
ht.put("audit", Boolean.TRUE);
ht.put("pivoted", Boolean.TRUE);
sa.reportEvent(Status.OK, "This should be written to audit log but is written to channel monitor", ht);
sa.reportEvent(Status.ERROR, "This should also be written to audit log but is written to channel monitor", ht);
If i print the content of my hashtable in the channel monitor I can see that my entries are put into the table just fine. The 'audit' entry just seems to be completely ignored.
Anyone have and suggestions?
Regards,
Daniel

Hi Guys,
I need to know what JAR file i need to download for the following packages from SAP PI.
import com.sap.aii.axis.monitor.Status;
import com.sap.aii.axis.monitor.StatusAgent;
import com.sap.aii.axis.utils.Constants;
I am doing AXIS custom modules and i need to write to the PI 7.1 Audit Logs.
Thanks in advance.
Raj

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

Audit Log query

Similar Messages

Maybe you are looking for