Audit : to trace who did truncate of the table possible ?

Hi,
Yesterday some one has truncated the table data, any idea we can find out who did it? please see the configurations of my database.
BANNER
Oracle8i Enterprise Edition Release 8.1.7.4.0 - Production
PL/SQL Release 8.1.7.4.0 - Production
CORE 8.1.7.0.0 Production
TNS for HPUX: Version 8.1.7.4.0 - Production
NLSRTL Version 3.4.1.0.0 - Production
SQL> !uname -a
HP-UX db05 B.11.11 U 9000/800 1440856852 unlimited-user license
SQL> show parameter audit;
NAME TYPE VALUE
audit_file_dest string ?/rdbms/audit
audit_trail string NONE
transaction_auditing boolean TRUE
SQL>
-rw-r----- 1 oracle dba 2547 Aug 4 11:30 ora_26430.aud
-rw-r----- 1 oracle dba 4777 Aug 4 11:40 ora_1097.aud
-rw-r----- 1 oracle dba 3410 Aug 4 11:50 ora_8746.aud
-rw-r----- 1 oracle dba 2746 Aug 4 12:01 ora_14307.aud
-rw-r----- 1 oracle dba 2062 Aug 4 12:01 ora_14435.aud
-rw-r----- 1 oracle dba 4105 Aug 4 12:10 ora_18744.aud
-rw-r----- 1 oracle dba 2052 Aug 4 12:20 ora_23523.aud
-rw-r----- 1 oracle dba 4119 Aug 4 12:30 ora_28396.aud
-rw-r----- 1 oracle dba 3411 Aug 4 12:40 ora_3120.aud
-rw-r----- 1 oracle dba 3412 Aug 4 12:50 ora_9679.aud
-rw-r----- 1 oracle dba 2737 Aug 4 13:10 ora_22368.aud
-rw-r----- 1 oracle dba 1368 Aug 4 13:20 ora_28745.aud
-rw-r----- 1 oracle dba 4094 Aug 4 13:30 ora_3831.aud
-rw-r----- 1 oracle dba 4103 Aug 4 13:34 ora_6515.aud

No, at this point because you did not have auditing turned on you cannot get the information desired. In my opinion you should configure all production databases to audit all DDL operations since you should create only once and reuse many times so auditing DDL should not generate much data.
The TRUNCATE command is a general exception to the above since for work/reporting tables I would espect that the table would be cleared out every time it is used but I would also expect the clearing user to be an application user which executes a stored procedure to perform the truncate and these are easy to filter out of any reports you run and to report on the use of the truncate procedure by any user other than the expected username.
If you set up auditing be sure to set up a purge at the same time.
IMHO -- Mark D Powell --

Similar Messages

How to truncate all the tables of my database

hi guys
I am using SQL Server 2012 , i need to delete all the data present in my database .I mean i want to truncate all the tables in my database , so please suggest me the easiest way .

If the tables are referenced by FK it will be failed....
Basically you can use the below statetemnt
DECLARE @TruncateStatement nvarchar(4000)
DECLARE TruncateStatements CURSOR LOCAL FAST_FORWARD
FOR
SELECT
N'TRUNCATE TABLE ' +
QUOTENAME(TABLE_SCHEMA) +
N'.' +
QUOTENAME(TABLE_NAME)
FROM
INFORMATION_SCHEMA.TABLES
WHERE
TABLE_TYPE = 'BASE TABLE' AND
OBJECTPROPERTY(OBJECT_ID(QUOTENAME(TABLE_SCHEMA) +
N'.' +
QUOTENAME(TABLE_NAME)), 'IsMSShipped') = 0
OPEN TruncateStatements
WHILE 1 = 1
BEGIN
FETCH NEXT FROM TruncateStatements INTO @TruncateStatement
IF @@FETCH_STATUS <> 0 BREAK
RAISERROR (@TruncateStatement, 0, 1) WITH NOWAIT
EXEC(@TruncateStatement)
END
CLOSE TruncateStatements
DEALLOCATE TruncateStatements
Best Regards,Uri Dimant SQL Server MVP,
http://sqlblog.com/blogs/uri_dimant/
MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting:
Large scale of database and data cleansing
Remote DBA Services:
Improves MS SQL Database Performance
SQL Server Integration Services:
Business Intelligence

Who maintained entries in the table

Hi,
I want to find out who maintained entries in the SAP table B006 and who all has authorization for the same.
Also it would be great if could help me to find a place in SAP where I can find the documentation realted to the table.

Check in SCU3 transaction.

Truncate all the tables

How can I write a script which will truncate me all the tables defined by a query similar to this: select table_name where tablespace_name != 'SYSTEM' ?

Look into dba_tables and spool a script/file that you can later run from SQLPlus:
select 'truncate table ' || owner || '.' || table_name || ';'
from dba_tables
where owner <> 'SYSTEM'
-Chuck

Buffer trace for more than 5 defined tables possible?

Hello!
With ST05 you can switch on a buffer trace. Using 'trace on for user' makes it possible to activate the trace for a defined number of tables. The number of tables is limmited to 5.
I would like to trace 100 tables. Is it possible to extend this formula. Is it possible to do this with one trace at one time?
Thanks,
Holger

Hi Holger!
You can, but you don't need to restrict the trace to specific tables.
So one option: just don't filter any tables and ignore the additional lines later in trace analysis.
Other option: use wildcards (e.g. MAR* for MARA; MARC; MARD tables)
If some tables are blowing up your trace, but aren't any performance problem -> use the exclude part.
Also a restriction to a special program can restrict the tables without using the tables filter explicit.
Also a filter in trace display can restrict the results - but it's still using more memory and time.
Regards,
Christian

Need to Audit ALTER, DROP or TRUNCATE on All Tables in a Schema

Hello,
I need to audit any ALTER, DROP or TRUNCATE on all tables in the "X" schema including operations done by the "X" account.
Oracle Version = 11g Release 11.1.0.6.0
audit_sys_operations = TRUE
audit_trail = XML, EXTENDED
Thanks!

Sky13 wrote:
Hi Srini;
After rereading my last post I have to apologize for being obnoxious. I have been trying:
No apology is necessary - you are not doing me any favors ;-)
audit alter table; This I get "Audit succeeded" Good - this means that any ALTER TABLE command issued by any user, whether the command is successful or not, will be logged.
audit truncate table; This I get "ORA-00956: missing or invalid auditing option" I do not have access to a database currently, so cannot verify what is wrong - it looks correct - pl verify syntax.
>
I see them both in the documentation you referenced and in another places. I am certain I am missing something.
Thanks for the help!!!! and again I apologize.You are welcome. I would suggest you experiment in a test database first :-)
HTH
Srini

How to find all the table used in a report

Hi Expert ,
Is there is any program to find out all the tables which are used in a perticular report .
Thanks in advance
Tarak

Well, so far Viquar Iqbal has given the only really correct answer - use SQL trace. The reason the others are incomplete, is because they don't consider that a report might call a function module or a class method that accesses a table. In fact, for many applications this is exactly what happens - db accesses are abstracted away from the main program.
The other alternative to SQL trace is to use Run Time Analysis. The advantage of SQL trace is that it shows the tables hit in order.
matt

Using Pages, I have created a document and inserted a Table for use in logging an inventaory. When I came to print this off however the lines for the table were missing but the text was in the Table format, weird! How do I print the Table?

Using Pages, I have created a document and inserted a Table for use logging an inventory. When I came to print this document the lines and boarders of the Table feature did not print however the text did print in the table format. How do I get the lines and boarders to print also?

Using Pages, I have created a document and inserted a Table for use logging an inventory. When I came to print this document the lines and boarders of the Table feature did not print however the text did print in the table format. How do I get the lines and boarders to print also?

What r the tables used for this report.

hi all..
i am a fresher for ABAP. i need the help.
what r the tables used for this report.
Reports provide pending order details according to Material wise and customer wise for particular month.
thanks in advance
RK.Ashokkumar.

Hi Ashok,
this is easy to do.
Open Two SAP Screen with same user ID.
Run SQL trace using ST05 transaction.Open ST05 transaction in One and make
Trace on ,Run the report in another screen.
Once report run is over.End the trace process and click on display trace in same ST05 transaction.There is a click button on ST05 Transaction screen to start trace
process,End trace process and Display track process.
The SQL trace will give you all the table details which is used in that particular report.
You have not mentioned about the report name so I have suggested this way.
regards,nishant
Please reward if this helps

Audit Of the System : How to identify easily Who did What ???

Hello,
Is there a way to report who did which transaction (in logistics, finance) thanks to a SQL query, XL Reporter, etc... ?
I'd like to get on a single report for instance the user name, transaction number, amount, etc....
Regards
Stéphane

Dear Stephane,
You might be able to pull up the report using the "Transaction Journal Report" already available under the Financials->Accounting->"Transaction Journal Report".
PLease try it out, if you need any thing not available in the report let us know.
Regards
Arshdeep

Trace to find who out who has deleted / modified the attendance record

Dear All
Some one has deleted the attendence record of a particular user of previous month , so how i can track who has deleted / modified the same in salary slip it is showing 1 leave record for the same month, but while checking throught pa30 there is no record shown for the same . can you please tell me how to trace that and which tables are updated once we update the attendence and while processing the salary slip , from which table it picks the leave availaed data .
Thx
Shilpa
Edited by: Shilpa on Nov 13, 2009 11:31 AM

Hi Shilpa,
You have to activate the audit Trail.
RPUAUD00 isthe program to see the changes in infotypes records, but before that you have to configure T585A, T585B, T585C
Regards,
Kapil Kaushal

Query to trace who updated the data

query to trace who updated the data
date
and time
and username

ahh, ok - there's a few articles around that will assist.
I suggest first
you experiment with triggers to familiarise yourself with them:
http://download.oracle.com/docs/cd/B19306_01/server.102/b14220/triggers.htm#CNCPT118
this article here explains the process of putting in some audit processes using triggers:
http://www.oracle-base.com/articles/9i/CompleteDataAudit.php
it details creating the tables etc and then provides a procedure that will create the trigger text for you for each table you want to audit. it would be good to write your own trigger from scrath in order to learn and understand exactly what's happening, but it's up to you.
let us know if you encounter any problems and we can help your specific problem

How to find out list user who did the printing

Dear All,
We are using network print server using HP LaserJet 5550 and jetdirect, since our number of users is more than 500 staff in one place, sometimes they do the unresponsible printing such as print full color photos for personal use, print a novel and anything that not related to the business purpose.
Today, our director found out that someone print out a whole story book and spend a lot of paper... he challenge me to find out who is the user who did this? I can log on to the printer web console, but I can't find user log printing...
Any help will be much appreciated.
Thanks & Regards,
Franky

This seems to be a commercial product. For the best chance at finding a solution I would suggest posting in the forum for HP Business Support!
You can find the Commercial Jetdirect board here:
http://h30499.www3.hp.com/t5/Print-Servers-Network-Storage/bd-p/bsc-254
Best of Luck!
You can say thanks by clicking the Kudos Star in my post. If my post resolves your problem, please mark it as Accepted Solution so others can benefit too.

How to find out the person who did a transport.

How to find out the person who did a transport.
There are 3 basis admins in our Org.
so is there a way of tracing out , who did what transport.
Regards,

- Goto import Overview (STMS)
- Import Queue
- Select DEV req (goto Import History)
- Edit - Display More
It will show the user who did the transport
Rgds

All of a sudden my email asks a password. I use Thunderbird at work and I have not set this password. The person who did left. How do I login now?

I really don't know computers.
I have been working here now for three months and it is just me who works here so I can't ask anyone.
It was working fine until all of a sudden when i press get mail i get:
please enter a password for user ...... on server ...... .
I have not set the pasword and I can't get in contact with the person who did.
Is there any chance of deleting it? Go passed it? I work at a hostel and we make all our bookings via email. I really need this to work!

You administer your email password with your email provider. You need to work with them to reset a forgotten password.
Go to their web mail or email help site and look for a link to reset your password.

Audit : to trace who did truncate of the table possible ?

Similar Messages

Maybe you are looking for