Auditing / logging scheduler external procedures?

Hi ,
I'm wondering if there's any way to audit the alter/execution of scheduler jobs which launch external procedures.
I've got some external procedures that are altered dynamically in the application. I can track down WHEN was executed the stdout and stderr in DBA_SCHEDULER_JOB_LOG and dba_scheduler_job_run_details views, and the results in $ORACLE_HOME/scheduler folder. But I cannot see WHAT was executed (i.e. the job_action parameter and/or the argument_value if there are arguments).
How can I achieve this?
Regards

If you can open a file from your external procedure written in C you can definitely write log messages.
1) Check the permissions on the directories the external procedure will be opening file and writing messages.
2) Create a test log file when you execute, if you do not give the path the file should get create in oracle software directories probably {ORACLE_HOME} path..
Let me know if this solution works
SS

Similar Messages

Security Audit Log SM19 and Log Management external tool

Hi all,
we are connecting a SAP ECC system with a third part product for log management.
Our SAP system is composed by many application servers.
We have connected the external tool with the SAP central system.
The external product gathers data from SAP Security Audit Log (SM19/SM20).
The problem is that we see, in the external tool, only the data available in the central system.
The mandatory parameters have been activated and the system has been restarted.
The strategy of SAP Security Audit Log is to create many audit log file for each application server. Probably, only when SM20 is started, all audit files from all application servers are read and collected.
In our scenario, we do not use SM20 since we want read the collected data in the external tool.
Is there a job to be scheduled (or something else) in order to have all Security Audit Log available (from all application servers) in the central instance ?
Thanks in advance.
Andrea Cavalleri

I am always amazed at these questions...
For one, SAP provides an example report ( RSAU_READ_AUDITLOG_EXTERNAL ) to use BAPIs for alerts from the audit log yet 3rd party solutions seem to be alergic to using APIs for some reason.
However, mainly I do not understand why people don't use the CCMS (tcode RZ20) security templates and monitor the log centrally from SolMan. You can do a million cool things in SolMan... but no...
Cheers,
Julius

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

Scheduling audit logs - variant for RSAU_SELECT_EVENTS

Hi,
I need some help as to how I should go about creating a variant for scheduling the audit logs using RSAU_SELECT_EVENTS as a weekly job.
I would like the job to run on a weekly basis (run on Sun) and to generate SM20 audit logs for that past week. For example, the job is to be executed (every) Sunday night (say, 22 Nov) and it will extract all logs between the previous Sun (15 Nov) thru to the current Sun (22 Nov).
My question is : how should the variant for the program "RSAU_SELECT_EVENTS" be created?
In this program, there's a "Time Restriction" section of "From Date" and "To Date". If I were to input 15 Nov (From Date) to 22 Nov (To Date) and schedule it weekly, then every week it is always going to extract the logs between 15 Nov and 22 Nov regardless of which Sun it was run - which is not correct.
How should the variant be created such that it will always extract the current past week?
I doubt this program can be used to achieve my requirements. Is there an alternative?
Thanks !

> I doubt this program can be used to achieve my requirements.
I raise your bet by 1 beer that it can...
=> When saving the variant, scroll along to the end of the selection options to a field called Selection Variables. Place your cursor in the date fields and press F4.
Do the same for the Name of the Variable field (tip: "-7")
Cheers,
Julius

External procedures Logging

What's the best way to logging external procedure? I don't have control of what extProc is reallly doing...
Thanks for your help...

If you can open a file from your external procedure written in C you can definitely write log messages.
1) Check the permissions on the directories the external procedure will be opening file and writing messages.
2) Create a test log file when you execute, if you do not give the path the file should get create in oracle software directories probably {ORACLE_HOME} path..
Let me know if this solution works
SS

ODSI 10Gr3 audit logs common/time question

Hi
With ODSI10GR3, We are investigating delays in processing of some DB2 Inserts
Inserst occur daily but th eproblem happens maybe once in a week
A review of the audit log during teh problem occurance shows the following
Comon/time is taking 33 seconds
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }
with compile time being ~ 14 sec and insert time being ~ 4 seconds
Is it possible that things such as full gc ooccuring can impact this time?
We increased tx timeout to 120 seconds to avoid the timeout but would like to investigate further on this.
Thanks Much for any info
Best
####<Mar 1, 2010 10:22:09 AM PST> <Info> <ODSI> <qa-sc-eibapp02.corp.test.com> <ds_ms2> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <service.uateibsads> <> <> <1267467729490> <BEA-000000> <ClientDataspace> <DSPAuditEvent timestamp: Mon Mar 01 10:21:36 PST 2010 severity: FAILURE id: ClientDataspace:48:Mon Mar 01 10:21:36 PST 2010 {
common/application {
user: service.uateibsads
name: ClientDataspace
eventkind: update
server: ds_ms2
query/performance {
compiletime: 14869
update/relational {
source: CBS_DB2_DS
sql: INSERT INTO "S109935E"."C@CR538"."C@CUNEW01" ("C@STATUS", "C@SEQNBR", "CUBK", "CUNBR", "CUSTAT",
"CUALT", "CUNA1", "CUNA2", "CUNA3", "CUNA4", "CUNA5", "CUNA6", "CUZIP", "CUZIP2", "CUZIP3",
"CUZIP4", "CUSHRT", "CUSSNR@", "CUSSTY", "CUCLPH", "CUHMPH", "CUBUPH", "CUPOFF", "CUSOFF",
"CUPOF1", "CUPOF2", "CUOPDT", "CUTYPE", "CUTYP", "CUSIC", "CUSEX", "CURACE", "CUOWN", "CUYREM",
"CUINC", "CUSRIN", "CUBDTE", "CUDEP", "CUCTC", "CUCTCT", "CUCIRA", "CUMNBR", "CUNTID", "CUUSR1",
"CUCLNK", "CUUSR3", "CUCDCH", "CUCDCN", "CUCDCD", "CUCMCH", "CUCMNR", "CUCMCD", "CUCVSH",
"CUCVCN", "CUCVCD", "CUCATH", "CUCATN", "CUCATD", "CUCLNG", "CUCCCD", "CULGLR", "CUCWHP",
"CUCPSP", "CUCTXN", "CUCPRF", "CUSHKY", "CUITLD", "CUPSTL", "CUACOM", "CUBRCH", "CUMIDT@",
"CUMRTS", "CUMAIL", "CUSOLI", "CUSOCI", "CUCPNA", "CUBPNA", "CUPERS", "CUSALU", "CUFAX",
"CUTELX", "CUTXAN", "CUDOCF", "CUDCDT", "CUTINU", "CUTADT@", "CUWPRT", "CUCECD", "CUCELM",
"CUEXTF", "CUMTND", "CUCNCD", "CUMARK", "CUEMPL", "CUINQ", "CUMNT", "CUCENS", "CUCODT", "CUDEDT",
"CUACCD", "CUBYR1", "CUBYR2", "CUPREF", "CUJBDT", "CUJDDT", "CUEMA1", "CUEMA2", "CUOPT",
"CUOPTD", "CUSPFG", "CUOENTTYP", "CUCENTTYP", "CUAMDT", "CUESDT", "CUENA1", "CUENA2", "CUENA3",
"CUENA4", "CUENA5", "CUENA6", "CUEPST", "CUEZIP", "CUEZIS", "CUEZP3", "CUEZP4", "CUAAPL",
"CUAAKY", "CUAREC", "CUASTA", "CUANA1", "CUANA2", "CUANA3", "CUANA4", "CUANA5", "CUANA6",
"CUAZP1", "CUAZP2", "CUAZP3", "CUAZP4", "CUAPSD", "CUASTR", "CUASTP", "CUASTS", "CUAFLG",
"CUARFG", "CUCLS", "CURISK", "CURDT1", "CURSK2", "CURDT2", "CUCRLN", "CUCRDT", "CUCRFR",
"CUCRND", "CUCRPR", "CUFSDT", "CUFSFR", "CUFSND", "CUSALE", "CUCSTS", "CUNETI", "CUPRJI",
"CUASST", "CUCURA", "CUCASH", "CUACCR", "CUMKTS", "CUREAL", "CULIFE", "CUINVN", "CUFIXA",
"CULIAB", "CUCURL", "CULTRM", "CUNETW", "CUDIRL", "CUINDL", "CUDIRT", "CUINDT", "CUREDB",
"CULCRO", "CUOTHA", "CUOTHL", "CU5WHP", "CUIWHY", "CUWHEX", "CUFILL", "CUREC1", "CUSTAD",
"CUFRN1", "CUCHIB", "CUCHID", "CUCLOB", "CUCLOD", "CUCCDD", "CUCDD1", "CUCDD2", "CUCHD1",
"CUCHD2", "CUCHP1", "CUCHP2", "CUCHP3", "CUCHP4", "CUCOL1", "CUCOL2", "CUCOL3", "CUCOL4",
"CUCCDT", "CUCCYD", "CUCTYD", "CUCIDB", "CUCDIR", "CUCIND", "CUCSEC", "CUCUNS", "CUCILD",
"CUCOPN", "CUCTOD", "CUCNON", "CUCHGO", "CUCRNB", "CUCQAG", "CUCQHU", "CUCQHI", "CUCQLO",
"CUCQDD", "CUCQDT", "CUDPD1", "CUDPD2", "CUDPD3", "CUDPDP", "CUDPD", "CUIPD", "CUUPD", "CUCAGY",
"CUCIAM", "CUCIAY", "CUCPAM", "CUCPAY", "CUCLTC", "CUCLSO", "CUUCMO", "CULCCA", "CUDRSD",
"CUFACS", "CUINDS", "CUIPDS", "CUSECS", "CUUNSS", "CUDPDS", "CUUCMS", "CUBDIR", "CUBCMO",
"CUTHR1", "CUTHR2", "CUTHR3", "CUTHR4", "CUTHR5", "CUFIV1", "CUFIV2", "CUFIV3", "CUFIV4",
"CUFIV5", "CUTEN1", "CUTEN2", "CUTEN3", "CUTEN4", "CUTEN5", "CUTWN1", "CUTWN2", "CUTWN3",
"CUTWN4", "CUTWN5", "CUTHI1", "CUTHI2", "CUTHI3", "CUTHI4", "CUTHI5", "CUSEV1@", "CUSEV2",
"CUSEV3", "CUSEV4", "CUSEV5")
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
rowsmodified: 1
time: 3655
common/application {
exception: Transaction timed out after 29 seconds
BEA1-000021E917F59C34B15A
update/service {
procedure: InsertNewCIF
arity: 1
dataservice: ld:CoreBankingSystem/LogicalServices/CreateNewCIF.ds
script: declare namespace ns0="ld:CoreBankingSystem/LogicalServices/CreateNewCIF";
declare namespace ns1="http://www.test.com/schemas/client/cbs/logical";
declare variable $__fparam0 as element(ns1:NewCIF)* external;
{ return value ns0:InsertNewCIF($__fparam0); }
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }

1) Is it possible that there is a database lock preventing the insert from being committed?
2) What does the audit look like for a successful update?
3) Notice that the "compile time" is non-zero. This indicates that the plan was not cached. Likely because it is the first time this was executed after the server was started. So not only do you have the extra query compilation time, there would also be time for loading classes and other initialization. (but 12 seconds of loading an initialization seems like a lot). Given that increasing the tx time to 120 seconds solves the problem (it does solve the problem, doesn't it?) I would say that this is the issue.
4) Given that you just started the server (right? see (3)), it's not likely this is due to GC. But you could enable gc verbose to see.

BOE XI 3.1 Removing Audit log files

Hi there experts,
we have an issue with our production BOE install (3.1 SP7) whereby we have over 39,000 audit log files awaiting processing in the BOE_HOME/auditing folder. These audit files were generated a few months back when we had an issue with the system whereby thousands of scheduled events were created, we are not sure how. The removal of these events has had a knock on effect in that we have too many audit files to process, ie the system just cant process them all quickly enough.
So my question is can we just remove these audit files from the auditing directory with no knock on effects as we dont need them loading into the audit database anyways as they are all multiples of the same event.
As an aside when we upgraded from SP3 to SP7 the problem went away, ie no new audit files for these delete events being generated. We are still to establish how/why these audit events were created but for the time being we just want to be able to remove them. Unfortunately as its a production system we don't want to just take a chance and remove them without some advice first.
thanks in advance
Scott

Is your auditing running now? Or still pending? Can you check in Audit DB, what is the max(audit_timestamp? This will tell you when was the recent actvitiy happened.
Deleting the audit files, will not harm to your BO system. You will not be able to see auditing details for that period.
Is the new auditing files are processed? or you still see the files created in auditing folder without processing?
If the auditing file size shows 0 okb, than it means they were processed.

Job log, audit log

Hi.
Are there any log files to delete manually periodic?
I know the log files are deleted by standard delete job scheduled in Tr-cd SM36.
How about the JOB log, and audit log?
regards,

Apart from SM36 standard logs,
you might want to re-orgnaize log/trace files in various directories:
/local/data/interface - generally the interface directory
/usr/sap/<SID>/../work - Work process trace files etc.
Regards,
Siddhesh

Audit log capacity

As auditing can be enabled and it keeps the audit logs. Is there a setting for audit retention configuration as well as size configuration. Also how uch space it occupied with average audit capabilities and how much is the growth.
This topic not much covered in docs. So I want to know from you guys as you must be having enough experience. Is there a criteria which can be used to plan database. Does it go to a seperate database table?
Any pointers can also be helpful.

The job 'Trims audit trail entries from site collections.'
It runs by defualt every month, which means you need to adjust the schedule so that it runs weekly so that it'll pick up your accelerated audit rules.
This is the job that exports the data to Excel and cleans up the entries from the database.

Audit Log query

I am trying to figure out why a query of the OID audit logs is taking so long....
the search filter is:
(&(orcleventtime>=20070426)(orcleventtime<=20070427)(orcleventtype=User login))
it takes 97 seconds to return 1622 entries.
when i run a query with this filter....
(&(orcleventtime>=20070426)(orcleventtype=User login))
it takes 0.2 seconds
any ideas?

Purging an AUD$ table is good idea after taking the export....
Yeah...that could be better idea to audit those things that application skips...
I was just getting calls from finance and operations departments... complaining that their ERP applications were haning taking long time to execute day end procedures and in reports...around 20 to 30 minutes.... as I recalled that my last deployment on live was enabling of auditing as I executed noaudit all and noaudit select, update, delete, insert on erp, The user got their day end procedures executed and report in less than 1 minute...
Can anybody explain me....Does auditing degrades performance..?
Regards?

Audit log trimmer timer job

HI
Audit log trimmer timer job
what this job do
I set the sitecollection audit settings to trim the audit data after 7 days
is this job before delete it generate Excel report and save in document library?
adil

The job 'Trims audit trail entries from site collections.'
It runs by defualt every month, which means you need to adjust the schedule so that it runs weekly so that it'll pick up your accelerated audit rules.
This is the job that exports the data to Excel and cleans up the entries from the database.

Problem in Calling External Procedure

Hello,
I am trying to call external procedure written in C from PL/SQL.
Here are the codes :
For external procedure:
#include<stdio.h>
void extproc_fn ( void )
FILE * file_handle;
if (( file_handle = fopen ( "/root/cprogs/extproc.out", "a" )) != NULL )
fwrite ( "External Procedure Testing", 26, 1, file_handle );
fclose ( file_handle );
I have created library as :
create or replace library extproc_lib as '/root/cprogs/extproc.so';
And the procedure :
create or replace procedure extproc_proc as
external
name "extproc_fn"
library extproc_lib
language c;
My listener and tnsname is configured correctly.
But when I try to connect to Oracle by that tnsname, extproc program core dumps under $ORACLE_HOME/network/log directory. Under WinNT, it creates a Dr. Watson error.
Any idea what might have gone wrong.
Thanks in advance.
Soumen Ghosh

hi there,
everything u did is correct as far as i recollect about external procedures ,the only thing that i suppose is missing is that u forgot to grant permissions on the library to the user...pls check this once i hope this works...
bye
Atul

URM Disposition Approval Error - Audit log

Hi there,
We have a URM environment installed and configured.
When attempting to approve a disposition action on an item in a retention schedule, the following error message appears:
"Unable to update DispositionsHistory table. Failed to check in audit log. Please reference '/appl/ucm/ContentServer/data/recordsManagement/log/##########.htm' audit log. You must save default metadata for checked in audit entries."
What is it here that we need to adjust in order to complete the approval?

Hello
You have to give your audit trail default metadatas. Under Administration-Configure Records Management-Audit-CheckedIn_Audit Entries you can find the Link for "Default Metadata for Checked-in Audit Entries".
Regards

CCMS and Security Audit log

I have seen a huge number of companies who do not use SM19/SM20 or RZ20. It is not configured. example I worked for 3 clients(user base 14000, 16000,1000) and none of them have this configuration.
Do you know why is it so if it is not configured at your place.
Thanks
Edited by: Pankaj Jain on Sep 26, 2009 7:02 PM

Performance impact is dependent on the Hardware sizing and the daily monitoring activities together with the back up schedule by the BASIS team.
My experience is: I have seen maximum of clients using this for logging activities of ALL users in the system. In other few cases, it is restricted to Super and Special users.
Please go through the document: [Security Audit Log|http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/2088d9d4-e011-2a10-bba9-90548dbc2d6a&overridelayout=true] (it's a bit Old)
Try searching Community with SM20 / SM19 / Security Audit Log search strings.
Regards,
Dipanjan

Access request Audit log

Hi experts,
For all the access requests we are getting the complete audit trail and Even we will get whether Risk Analysis is scheduled in the Workflow.
But is there any possibility to get the output of Risk Analysis in the audit trail?
Please suggest.
Thanks,

Hi Sriram,
in standard solution what you can see in audit log is the information risk analysis during access request was executed, there is no standard way to see this information in audit log.
If you go for abap customization, please note this information is usualy very big and long and adding it to audit log my simply make audit log unclear...and very much complicated.
Hope this helps,
Filip

Auditing / logging scheduler external procedures?

Similar Messages

Maybe you are looking for