BOE XI 3.1 Removing Audit log files

Hi there experts,
we have an issue with our production BOE install (3.1 SP7) whereby we have over 39,000 audit log files awaiting processing in the BOE_HOME/auditing folder. These audit files were generated a few months back when we had an issue with the system whereby thousands of scheduled events were created, we are not sure how. The removal of these events has had a knock on effect in that we have too many audit files to process, ie the system just cant process them all quickly enough.
So my question is can we just remove these audit files from the auditing directory with no knock on effects as we dont need them loading into the audit database anyways as they are all multiples of the same event.
As an aside when we upgraded from SP3 to SP7 the problem went away, ie no new audit files for these delete events being generated. We are still to establish how/why these audit events were created but for the time being we just want to be able to remove them. Unfortunately as its a production system we don't want to just take a chance and remove them without some advice first.
thanks in advance
Scott

Is your auditing running now? Or still pending? Can you check in Audit DB, what is the max(audit_timestamp? This will tell you when was the recent actvitiy happened.
Deleting the audit files, will not harm to your BO system. You will not be able to see auditing details for that period.
Is the new auditing files are processed? or you still see the files created in auditing folder without processing?
If the auditing file size shows 0 okb, than it means they were processed.

Similar Messages

Maximum number of events per audit log file must be greater than 0.

BOE-XI (R2)
Windows Server 2003
Running AUDIT features on all services.
Report Application Server (RAS) keeps giving the following error in the Windows Application Event Log.
Maximum number of events per audit log file must be greater than 0. Defaulting to 500.
I am assuming that this is because the RAS is not being used by anyone at this time - and there is nothing in the local-audit-log to be copied to the AUDIT database.
Is there any way to suppress this error...?
Thanks in advance for the advice!

A couple more reboots after applying service pack 3 seemed to fix the issue.
Also had to go to IIS and set the BusinessObjects and CrystalEnterprise11 web sites to use ASP .NET 1.1 instead of 2.

How to remove all log files at application end ?

I need to remove all log files from database dir.
Just the data file must be in database diretory after the application ends.
I´v tried:
1 - set_flags(DB_LOG_AUTOREMOVE, 1);
2 - txn_checkpoint(0, 0, DB_FORCE);
But ways one log file reminds.
Any bory nows how remove all log files at application end ?
I really need this. How can i do that in C++ ?
Thanks,
DelNeto

Here's how I solved it
// At end of app.
// Commit tables.
pdbParam     ->sync(0);
pdbUser     ->sync(0);
// Close tables.
pdbParam     ->close(0);
pdbUser     ->close(0);
// Delete table objects.
delete     m_pdbParam;
delete     m_pdbUser;
// Commit all changes to the database.
penvDbEnv->txn_checkpoint(0, 0, DB_FORCE);
penvDbEnv->close(0);
delete penvDbEnv;
// Remove all logs files comes here.
DbEnv *penvDbEnv;
penvDbEnv = new DbEnv(0);
ui32EnvFlags = DB_CREATE |
DB_PRIVATE |
DB_INIT_LOCK |
DB_INIT_LOG |
DB_INIT_MPOOL |
DB_THREAD |
DB_INIT_TXN;
// Open the environment with full transactional support.
iResult = penvDbEnv->open("..\\database", ui32EnvFlags, 0);
// Get the list of log files.
char **pLogFilLis;
char **pLogFilLisBegin;
iResult = penvDbEnv->log_archive(&pLogFilLis, DB_ARCH_ABS | B_ARCH_LOG);
// This line resets the log sequence numbers from the database file.
// No actual log file is associated with the database.
iResult = penvDbEnv->lsn_reset("..\\database\\DATABASE.db", 0);
// Remove the log files.
if(pLogFilLis!= NULL)
// I don´t now how put spaces and tabs here, sorry about the "___".;-).
__for(pLogFilLisBegin = pLogFilLis; *pLogFilLis != NULL; ++pLogFilLis)
____iResult = remove(*pLogFilLis);
__free(pLogFilLisBegin);
// At this point no more log files exists at database directory.
penvDbEnv->close(0);
delete penvDbEnv;
// If i need remove the environment files, do this.
penvDbEnv = new DbEnv(0);
penvDbEnv->remove(("..\\database", 0);
delete m_penvDbEnv;
Thanks to Bogdan Coman for show me the way
DelNeto.

Any software/program that can read audit log files

Hi,
Currently i am searching for a program/tools that can read audit log files and format it into a readable format. Anyone know is there any in the market or any open source program?
Thank You.

Not sure what you mean by "audit log".
Anyway. Pete Finnigan's tools page has only one thing that might be what you're looking for - LMON, which runs on BSD, Solaris, Linux. As he's the go-to guy for Oracle security the chances of there being a good free log analyzer tool that he hasn't heard of is slight.
Cheers, APC

Oblix v7 audit log file missing

Hi,
I'm using oblix v7.
I have enabled audit logs and specified the file name as: C:\audit33.txt
But on the machine there is no such file. It is somehow missing.
The same configuration works on another machine.
Any idea why the audit log file is missing?
Thanks.
Sash.

I response myself.
There is no way to set the Date/Time format to any other than UTC for the OAM component logs
See note 742777.1 for deeph information.
Julio.

Bad date recorded by AccessServer in Audit Log File

Hi all,
I have installed OAM and configure Audit Log File to AccessServer:
Access System Configuration >> Access Server Configuration >> and put ON "Audit to File"
The log is recorded OK, but when compare the date writed in log file with SO date, there are 6hs of diference
LOG FILE
01\/28\/2009 *00:18:07* \-0500 - AUTHZ_SUCCESS - GET - AccessServer - 192.168.3.105 - sec.biosnettcs.com\/access\/oblix\/lang\/en\-us\/msgctlg.js - cn=orcladmin\,cn=Users\,dc=biosnettcs\,dc=com - 00:18:07 - http - AccessGate - - 2
SO date
# date
mar ene 27 *18:18:15 CST* 2009
# date -u
miÃ© ene 28 *00:18:23 UTC* 2009
How we can see in this lines the audit log is recording date in UTC, but a need this in the timezone setted in SO.
How can do this (print date in audit log file with the same timezone setted by SO)??
Thaks in advance,
Julio

I response myself.
There is no way to set the Date/Time format to any other than UTC for the OAM component logs
See note 742777.1 for deeph information.
Julio.

The format of Audit log file

We have a perl script to extract data from Audit log files(Oracle Database 10g Release 10.2.0.1.0) which have format as bellow.
Audit file /u03/oracle/admin/NIKKOU/adump/ora_5037.aud
Oracle Database 10g Release 10.2.0.1.0 - Production
ORACLE_HOME = /u01/app/oracle/product/10.2.0
System name:     Linux
Node name:     TOYDBSV01
Release:     2.6.9-34.ELsmp
Version:     #1 SMP Fri Feb 24 16:54:53 EST 2006
Machine:     i686
Instance name: NIKKOU
Redo thread mounted by this instance: 1
Oracle process number: 22
Unix process pid: 5037, image: oracleNIKKOU@TOYDBSV01
Sun Jul 27 03:06:34 2008
ACTION : 'CONNECT'
DATABASE USER: 'sys'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL:
STATUS: 0
After we update the db from Release 10.2.0.1.0 to Release 10.2.0.4.0, the format of Audit log file had been changed to something likes below.
Audit file /u03/oracle/admin/NIKKOU/adump/ora_1897.aud
Oracle Database 10g Release 10.2.0.4.0 - Production
ORACLE_HOME = /u01/app/oracle/product/10.2.0
System name:     Linux
Node name:     TOYDBSV01
Release:     2.6.9-34.ELsmp
Version:     #1 SMP Fri Feb 24 16:54:53 EST 2006
Machine:     i686
Instance name: NIKKOU
Redo thread mounted by this instance: 1
Oracle process number: 21
Unix process pid: 1897, image: oracle@TOYDBSV01
Tue Oct 14 10:30:29 2008
LENGTH : '135'
ACTION :[7] 'CONNECT'
DATABASE USER:[3] 'SYS'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[0] ''
CLIENT TERMINAL:[7] 'unknown'
STATUS:[1] '0'
Because we have to rewrite the perl script, could anyone tell us where we can find the manual to describe the format of the Audit log file.

Oracle publishes views of the audit trail data. You can find a list of the views for the 11.1 database here:
http://download.oracle.com/docs/cd/B28359_01/network.111/b28531/auditing.htm#BCGIICFE
The audit trail does not really change between patchsets as that would constitute underlying structure changes and right now, the developers are not allowed to change the underlying structure of tables in patchsets. But, we can change what may be displayed in a column from patchset to patchset. For example, we are getting ready to update the comment$text field to display more information like dblinks and program names.
I personally don't like overloading the comment$text field like that, but sometimes when you need the information, that is the only choice except to wait for the next major release :)
As for the output of the audit log files, those can change between patchsets because of bugs that were found and some changes to support Audit Vault. My apologies out there for anyone that is reading the audit files written to the OS directly, I would recommend using the views.
Hope that helps. Tammy

Auto remove of log files on the client-side is not working

Hi,
I have a setup for one-to-one client/server replication database. Everything is replicated ok.
But on the client side, I see the log.00000000xx files are not removing at all,
while the server has only 2 last log.00000000xx files left. But if I switch the role of the client/server,
the newly server will eventually removed the unused log.00000000xx file, and have two last log file left.
Both client and server database environment setup has called dbenvp->log_set_config(dbenvp, DB_LOG_AUTO_REMOVE, 1).
Is there any additional setting for the client-side to auto remove the unused log files?
Thanks,
Sandra

Hi.
First, what version are you running? We created a test to confirm that this feature is
working as expected on both a master and a client site. What flags do you have set
for replication? I think we need to have you run with replication verbose messages
set on the client site and possibly other diagnostics in order to determine what is different
about your setup. We should take that level offline. Verbose messages can generate
a large amount of output.
You can contact me at the typical [email protected] and we'll move it
forward that way. Thanks.
Sue LoVerso
Oracle

How to remove archive log files from ASM managed 11g R2 database?

Hi,
I am planning to automate deletion of older archive log files from my 11g R2 Production instance which is ASM managed.
Also want to remove the archive log files files from standby database.
Please provide your inputs on how can I remove the older archive log files.
Regards,
Avinash

Greetings
Did you check RMAN,
RMAN>show all;
CONFIGURE RETENTION POLICY . . . .
CONFIGURE ARCHIVELOG DELETION POLICY TO [CLEAR | NONE | APPLIED ON STANDBY];
DELETE NOPROMPT EXPIRED ARCHIVELOG ALL;
DELETE NOPROMPT ARCHIVELOG ALL COMPLETED BEFORE 'SYSDATE-10';
This will be part of your RMAN Backup scripts/process
Check the urls below:
11gRel2:
http://download.oracle.com/docs/cd/E11882_01/backup.112/e10642/rcmmaint.htm#BRADV90079
http://download.oracle.com/docs/cd/E11882_01/backup.112/e10642/rcmmaint.htm#BRADV89634
10g:
http://download.oracle.com/docs/cd/B19306_01/backup.102/b14193/toc.htm#sthref45
http://download.oracle.com/docs/cd/B19306_01/backup.102/b14191/rcmconc1.htm#i1008093
http://download.oracle.com/docs/cd/B19306_01/backup.102/b14192/maint003.htm#sthref712
Regards & Thanks
BN

How to remove archive log files using Enterprise Manger

Hi,
I took backup of the archive log files and i deleted those files at OS level but it is not reflecting in the Enterprise Manager it is showing the same. Can any one help in how to delete the archive log files by using Enterprise Manger.
version 10.2.0.1.0
any help is appreciated.
Regards,
Ashraf

I have the same problem. I have 10gr1 and 10gr2 on different servers. On 10gr1, under administration/manage current backup/image, I can see archivelog files, and can mange them. But on 10gr2, the image doesn't show archivelog files. I can only remove them using rman. I wonder if it's because the different design on 10gr2 or I missed something when setup the backup?

Cannot remove 2nd log file on AlwaysOn database

Hi all,
I have a database, member of an availability group. This database has 2 log file, I want to remove the unsed secondary log file, I try to run this command to empty the second lofg file:
USE [TEST-AG]
GO
DBCC SHRINKFILE (N'TEST-AG_log_2' , EMPTYFILE)
GO
the command completes successfully, the I run the command to remove the file:
USE [TEST-AG]
GO
ALTER DATABASE [TEST-AG] REMOVE FILE [TEST-AG_log_2]
GO
But this command fails with the following message:
Error 5042: The
file 'TEST-AG_log_2' cannot
be removed because it is not empty.
If I remove the database from availability group the command to remove the 2nd file works, so I can't remove a secondary log file on a database member
of an alwayson availability grup?

Hi all,
I have a database, member of an availability group. This database has 2 log file, I want to remove the unsed secondary log file, I try to run this command to empty the second lofg file:
USE [TEST-AG]
GO
DBCC SHRINKFILE (N'TEST-AG_log_2' , EMPTYFILE)
GO
the command completes successfully, the I run the command to remove the file:
USE [TEST-AG]
GO
ALTER DATABASE [TEST-AG] REMOVE FILE [TEST-AG_log_2]
GO
But this command fails with the following message:
Error 5042: The file 'TEST-AG_log_2' cannot
be removed because it is not empty.
If I remove the database from availability group the command to remove the 2nd file works, so I can't remove a secondary log file on a database member of an alwayson
availability grup?
Remove the database from availability group, then remove 2nd file. You have been successfully. Then add back database to the availability group, then create regular backup jobs of the database.

Removing archived log files

Hello all,
Using Oracle 10g R2 ( 10.2.4.0) under UNIX Sun Solaris 10 , I have two rman backup types
1-L0 backup
2-L1 Backup ( Incremental cummulative)
Facts:
-Due to space pressure on archived log destination I'm trying to get less archived files possible under the archived log fs thus at any given time the archived log files destination contains archived log files aged no more than 22hours.
* The backup runs each day at 4PM and there is custom script that remove and compressed archived log files ( out of backup jobs windows) from midnight until 3:45PM
* From the above removal schedule task L0 or L1 backup will always have 24 hours worth of archived log files available during the backup.
-The Backup files Windows retention period is 22 hours meaning that each backup type L0 or L1 removes previous backup files aged more than 22hours.
-Tracking file is enabled
Target:
Knowing that our backup retention windows is 22hours.
Our next goal is to get less than 2 hours from 24 hours of archived log files available when L0 or L1 backup.
Would this affect L1 backup? and how?
Thank in advance for your response
Alex

user8979607 wrote:
Hello all,
Using Oracle 10g R2 ( 10.2.4.0) under UNIX Sun Solaris 10 , I have two rman backup types
1-L0 backup
2-L1 Backup ( Incremental cummulative)
Facts:
-Due to space pressure on archived log destination I'm trying to get less archived files possible under the archived log fs thus at any given time the archived log files destination contains archived log files aged no more than 22hours.
* The backup runs each day at 4PM and there is custom script that remove and compressed archived log files ( out of backup jobs windows) from midnight until 3:45PM
* From the above removal schedule task L0 or L1 backup will always have 24 hours worth of archived log files available during the backup.
-The Backup files Windows retention period is 22 hours meaning that each backup type L0 or L1 removes previous backup files aged more than 22hours.
-Tracking file is enabled
Target:
Knowing that our backup retention windows is 22hours.
Our next goal is to get less than 2 hours from 24 hours of archived log files available when L0 or L1 backup.
Would this affect L1 backup? and how?
Thank in advance for your response
AlexI'm not sure what you are talking about with Backup files Windows retention period ... 22 hours".
I don't know what you mean by "Our next goal is to get less than 2 hours from 24 hours of archived log files available when L0 or L1 backup."
If you are not taking your database backups with rman you are on shaky ground. The principles are simple. To recover your database from a failure, you will need to start with an L0 backup. The rman RESTORE command will then restore individual blocks from any applicable and available L1 backups. You would follow that with a RECOVER command, that would attempt to apply all necessary redo from available archivelogs. If the necessary archivelogs have been deleted, rman will attempt to restore them from a backup. You can use rman to backup AND DELETE archivelog files to keep the archivelog destination cleaned out.
I take an L0 backup once a week, an L1 the other 6 days, and archivelogs twice a day. The only time I've had a problem with the archivelog dest filling up is when some buggy code that has a loop goes into production and starts flooding redo.
Exactly how are you taking your database backups? If you are not using rman, then you are already on shaky ground.

Removing Redo Log Files? What's Normal?

Hello,
I'm new to Oracle and I've been using Informix for years. We currently have Oracle 9.2 running on Windows 2000 Server machine and apparently the redo log files keep filling up the disk drives they reside on. This is happening about every two weeks since we go out and delete the files when we remember.
My question is does Oracle have a "normal" way of removing old redo logs automatically rather than having to remove them manually? In the Informix world I can set the logical logs so that they write over previously used logs once they are no longer used. Is there a similar way to configure Oracle?
Thanks for helping out.
Gregg Walker

Do not delete your old log files: you need them.
That's how Oracle does recovery when you lose a datafile or a drive. You copy over the missing stuff from your back-up and then Oracle re-applies the chnages from the REDO logs thereby bringing your database back up to date. No work lost. Result!
Of course, if you don't take up a backup then holding on to REDO logs is pointless. In which case, set the database to run in NOARCHIVELOG mode.
However, I strongly advise you to run in ARCHIVELOG mode. You may find this part of the administrator's guide informative: http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96521/archredo.htm#4553
Cheers, APC

Remote management audit log file

I've read the documentation @
http://www.novell.com/documentation/...a/ad4zt4x.html
which indicates that the audit file is auditlog.txt and is located in the
system directory of the managed workstation. The problem is I can't find the
log file in that location or anywhere else on the computer. I even looked in
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent but I can't find
anything. Any ideas? Can someone point me in the right direction.
BTW, I'm using ZDM 6.5 SP2 for both the server and the workstations.
Jim Webb

Just an FYI, with ZDM 6.5 HP3 the file name changed from AuditLog.txt to
ZRMAudit.txt still located under system32 on Windows XP.
Jim Webb
>>> On 5/22/2006 at 3:27 PM, in message
<[email protected]>,
Jim Webb<[email protected]> wrote:
> Well I found out the ZDM 6.5 HP2 fixes the problem of the log file not
> being
> created.
>
> Jim Webb
>
>>>> On 5/19/2006 at 8:37 AM, in message
> <[email protected]>,
> Jim Webb<[email protected]> wrote:
>> Well, it does show up in the event log but not in the inventory. If I
>> disable inventory the log file won't be deleted, correct?
>>
>> Jim Webb
>>
>>>>> On 5/18/2006 at 10:03 AM, in message
>> <[email protected]>, Marcus
>> Breiden<[email protected]> wrote:
>>> Jim Webb wrote:
>>>
>>>> I did a search on a machine I am remote controlling, no log file. What
>>>> next?
>>> good question... does the session show up in the eventlog?

Growing nsure audit log file in sys\etc\logcache

I have a Netware 6.5 OES2 server that suddenly had a quickly growing file in the \sys\etc\logcache folder. The file has just recently stabilized, but I would like to shrink the file. I am aware that this is part of NSure auditing and would like to leave that running. Can the files in this directory be deleted, or how to I go about shrinking or truncating them?
Thanks.

That would be OES, as OES2 only exists on Linux.
TID 10089097 seems to cover this in a general sense:
configuring the PA on NetWare, is to configure the eDirectory, Filesystem, and Netware OS instrumentation. This is done at the NCP server object in iManager. From the eDirectory Administration task list, select Modify Object. Browse for server object. This is the NCP server object, in the tree, not the Secure Logging Server object in the Logging Services container. Click on the Nsure Audit tab. Below the tab, there will links to the individual components, eDirectory, NetWare, and Filesystem.
Without having it installed myself, I would expect that you could reset log files and suchlike in there.

BOE XI 3.1 Removing Audit log files

Similar Messages

Maybe you are looking for