Collecting File System Audit logs with Audit Vault

Can Audit Vault collect multi-platform OS file system audit records and logs as well as network component logs from switchs and routers in addition to DB audit records to satisify ICD 503/NIST/DOD auditing requirements? If not could it be configured to do so?
thanks

it only collect data from databases which may be oracle or non-oracle.
Oracle Audit Vault automates the consolidation and monitoring of audit data from Oracle and non-Oracle databases.
http://www.oracle.com/technetwork/products/audit-vault/overview/index.html

Similar Messages

Report RPUAUD00 Infotype audit log with date & time

Hi all,
I want to know from where the time is captured when we execute Report RPUAUD00 Infotype audit log?
I want to know from which fields or tables or structures?
We want to use the same logic in a custom report.
Your help appreciated.
Thanks & regards,
Vikas

Hi,
Infotype logs are maintained in PCL4 cluster. You can use fn modules HR_INFOTYPE_LOG_GET_LIST
and HR_INFOTYPE_LOG_GET_DETAIL to get infotype logs.
Thanks,
Aravind

How to get access to the local file system when running with Web Start

I'm trying to create a JavaFX app that reads and writes image files to the local file system. Unfortunately, when I run it using the JNLP file that NetBeans generates, I get access permission errors when I try to create an Image object from a .png file.
Is there any way to make this work in Netbeans? I assume I need to sign the jar or something? I tried turning "Enable Web Start" on in the application settings, and "self-sign by generated key", but that made it so the app wouldn't launch at all using the JNLP file.

Same as usual as with any other web start app : sign the app or modify the policies of the local JRE. Better sign the app with a temp certificate.
As for the 2nd error (signed app does not launch), I have no idea as I haven't tried using JWS with FX 2.0 yet. Try to activate console and loggin in Java's control panel options (in W7, JWS logs are in c:\users\<userid>\appdata\LocalLow\Sun\Java\Deployment\log) and see if anything appear here.
Anyway JWS errors are notoriously not easy to figure out and the whole technology in itself is temperamental. Find the tool named JaNeLA on the web it will help you analyze syntax error in your JNLP (though it is not aware of the new syntax introduced for FX 2.0 and may produce lots of errors on those) and head to the JWS forum (Java Web Start & JNLP Andrew Thompson who dwells over there is the author of JaNeLA).

SUN VM Shared File Systems make Errors with lucreate

Hi,
I have a problem with an attached A5200 with mirrored disks (Solaris 9, Volume Manager). Whereas the "critical" partitions should be copied to a second system disk, the mirrored partitions should be shared.
Here is a script with lucreate.
/usr/sbin/lucreate \
-l ${Logdir}/$0.log \
-o ${Logdir}/$0.error \
-m /:/dev/dsk/c2t0d0s0:ufs \
-m /var:/dev/dsk/c2t0d0s3:ufs \
-m /opt:/dev/dsk/c2t0d0s4:ufs \
-m -:/dev/dsk/c2t0d0s1:swap \
-n disk0
And here is the output
root@ahbgbld800x:/usr/local/LUscripts >./lucreate_disk0.sh
Discovering physical storage devices
Discovering logical storage devices
Cross referencing storage devices with boot environment configurations
Determining types of file systems supported
Validating file system requests
Preparing logical storage devices
Preparing physical storage devices
Configuring physical storage devices
Configuring logical storage devices
Analyzing system configuration.
INFORMATION: Unable to determine size or capacity of slice </dev/md/RAID-INT/dsk/d0>.
ERROR: An error occurred during creation of configuration file.
ERROR: Cannot create the internal configuration file for the current boot environment <disk3>.
Assertion failed: *ptrKey == (unsigned long long)_lu_malloc, file lu_mem.c, line 362<br />
Abort - core dumped

Hello.
(sys01)root# devfsadm -Cv
(sys01)root# To be on the safe side, I even rebooted after having run devfsadm.
--($ ~)-- sudo env LC_ALL=C LANG=C lustatus
Boot Environment           Is       Active Active    Can    Copy
Name                       Complete Now    On Reboot Delete Status
d100                       yes      yes    yes       no     -
--($ ~)-- sudo env LC_ALL=C LANG=C lufslist d100
               boot environment name: d100
               This boot environment is currently active.
               This boot environment will be active on next system boot.
Filesystem              fstype    device size Mounted on          Mount Options
/dev/md/dsk/d100        ufs       16106660352 /                   logging
/dev/md/dsk/d201        swap       1073875968 -                   -In the rebooted system, I re-did the original lucreate:
<code>--($ ~)-- time sudo env LC_ALL=C LANG=C PATH=/usr/bin:/bin:/sbin:/usr/sbin:$PATH lucreate -n S10U6_20081207 -m /:/dev/md/dsk/d200:ufs</code>
Copying.
*{color:#ff0000}Excellent! It now works!{color}*
Thanks a lot,
Michael

Partitioning previously used Windows NT File System for use with Mac and PC

With reference to this thread I found when searching for a solution: Can Windows NT File System(NTFS) format external hard drive work on iMac?
Below is the comment which led to me creating this new thread.
"rkaufmann87Sep 8, 2014 8:26 AM Re: Can Windows NT File System(NTFS) format external hard drive work on iMac?
in response to djj19
djj19 wrote:
Hi there,
I am about to follow your advice also for the same issue, the worry I have is that when I select partition 1, it says "To erase and partition the selected disk..." and so I am worried that if I do this it will erase the current contents of the hard disk drive (which were copied there from PCs in previous use).
If so, is there a way to use the hard disk drive with a mac without erasing the contents?
Thanks
Your case is different and NO do not partition the EHD yet unless you are prepared to completely erase your PC data. Before progressing though, do you intend to share the EHD with a PC and your Mac? If so this is not advisable but it is possible, however you will need to compromise. Please answer that question first and then we can proceed with some advice.
BTW it's generally not a good idea to ask a question in a thread that has already been answered, particularly one that is 3+ years old! In such a case it's normally better to create your own thread. "
The answer to the question in the above comment is that ideally I would like to use with both Mac and PC, why is this not advisable?
Please discuss my best options. I am wondering if I could transfer the current contents of the disk drive elsewhere, partition (which would erase) the disk drive, then put back the contents along with the new files which I have been trying to put on in the first place?
If this were to work would I then be tied down to only using this disk drive with a Mac?
Thank you.
Message was edited by: djj19

Ideally it is best to have seperate (discreet) EHD's for a PC and Mac due to their differences in HD formatting. However, this is not always feasable but there are alternative solutions availble. Among those are:
Creating and useing a Dropbox account that can be shared by PCs, Macs, IOS and Android devices. Dropbox allows for 2GB of free storage and additional storage is available for a small monthly fee.
Another possiblity is formating an EHD so that it may be shared by both a PC and Mac, this format is FAT 32. The downside of doing this is the size of the files written to the HD are limited to 4GB.

Convert ZFS root file system to UFS with data.

Hi, I would need to covert my ZFS root file systems to UFS and boot from the other disk as a slice (/dev/dsk/c1t0d0s0)
I am ok to split the hard disk from root pool mirror. any ideas on how this can be acheived?
Please sugget. Thanks,

from the same document that was quoted above in the Limitations section:
Limitations
Version 2.0 of the Oracle VM Server for SPARC P2V Tool has the following limitations:
Only UFS file systems are supported.
Only plain disks (/dev/dsk/c0t0d0s0), Solaris Volume Manager metadevices (/dev/md/dsk/dNNN), and VxVM encapsulated boot disks are supported on the source system.
During the P2V process, each guest domain can have only a single virtual switch and virtual disk server. You can add more virtual switches and virtual disk servers to the domain after the P2V conversion.
Support for VxVM volumes is limited to the following volumes on an encapsulated boot disk: rootvol, swapvol, usr, var, opt, and home. The original slices for these volumes must still be present on the boot disk. The P2V tool supports Veritas Volume Manager 5.x on the Solaris 10 OS. However, you can also use the P2V tool to convert Solaris 8 and Solaris 9 operating systems that use VxVM.
You cannot convert Solaris 10 systems that are configured with zones.

Can't read log files from /var/log with Geany

With the few exeptions like hibernate.log, I can't read most of those files, including:
everything.log
errors.log
kernel.log
messages.log
syslog.log
When I try to open them (as root), all I get is
The file xxx.log does not look like a text file or the file encoding is not supported.
However, they do open with nano
Last edited by Lockheed (2013-06-20 14:20:11)

If you want to only view the files (I assume this since those are logs), maybe try
$ less -M <file>
You can navigate pretty well with it (e.g. go to a specific line).
Edit:
You could also try to find if there is an option in Geany that would allow you to see "non-text" files.
Last edited by msthev (2013-06-20 18:41:27)

Implementing a remote file system to use with JFileChooser

Hi all
What I want to do is create a virtual file system so that I can browse through it with JFileChooser, select a file, and then take the correct action. If anyone has something like this that they can post it'd be much appreciated. Otherwise, does anyone have any advice about creating a navigation tool for traversing a vertual file system?

It appears that some people have indeed created some graphical FTP clients incorporating JFileChooser capabilities. The first entry on the search (and a few others) appear useful.
http://www.google.com/search?num=100&hl=en&c2coff=1&q=java+ftp+client+jfilechooser

Problem with the XI-Audit log entries in the table "XI_AF_MSG_AUDIT"

Hi,
I have an async-szenarios for PO:
We send Idoc's from SAP ERP to a WebService via SOAP. And we take Ack's. We use Integrationsprocess with deadline block to catche the errors after the retrying (three times) and to send they via e-mail.
Our problem is, the number of the audit logs in the table "XI_AF_MSG_AUDIT":
In the RTW only we see one audit log (with three retries) in an error case. But in the table XI_AF_MSG_AUDIT there are about 76 entries for the same audit log in the error case and about 20 entries in the case of the succuessfull processing.
This number of the entries in the table causes problem with the size of the redo log file and delete job of cours the large size of the table and therefore problem on the data base. The table can not be controlled. The delete job can not run and cancels every time due this redo log problems
What can cause that?
How can it be prevented, that so much entries are not be made in the table "XI_AF_MSG_AUDIT".
Best regards
Gueltekin

Hi Gueltekin,
I am only aware of the general property auditLogEnabled of J2EE Engine Service SAP XI AF Core, which controls in general (default = true) that entries in the AF Message Audit log are written at all.
(see [http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm|http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm])
I assume that your scenarios in the error case is sending up to three messages and for each message the number of audit log infos are created. You might want to check the detailed entries in the log and see from where they are comming, you might use customer modules etc. as well.
Best regards,
Silvia

Customizing Audit Log Report - Adding/Removing Columns from Display

Hi All -
Has anyone tried adding/removing the columns from Out of Box Auditi Log report with minor customizations to the code/configuration files ? Right now , when the Audit Log report is executed, there are numbe of columns that appear on report (Server, Client IP etc) which are too technical for the client and requirement is remove some of these and add some more for the attributes that we are audit logging through Audit workflow service. If you have done something similar in the past, please provide me with some inputs. Any sample code, examples will be highly appreciated.

Hello Gurus,
I also have same kind of requirement.WE have to send a monthly report to customer where number of users created and deleted to be given to them.
Its urgent.Please help
Thanks in advance

Trace level of RWB's Message Monitoring - Detail Message - Tab "Audit log"

Hi,
My flow is: File -> PI -> Transformed File with seeburger module. Everything is good except the trace level in RWB.
Exactly, in our PI production, under RWB -> Message Monitoring, when I select a message (e.g PI -> Outside) and see its Detail, under tab "Audit Log", I have a log with only 2 pages (which corresponds to the sender part "File -> PI")... whereas in our PI pre-production, I have 4 pages for the exact same flow, on which I have also info of the receiver part "PI -> Outside"...
My question is just: do you know which parameter is involved in this trace level of RWB's Message Monitoring Detail log ?
regards.
Mickael
Note: in [Help SAP|http://help.sap.com/saphelp_nw04/helpdata/en/fd/16e140a786702ae10000000a155106/frameset.htm], I see only this sentence "Audit Log: The audit log for the selected message is displayed as the default setting.".
Edited by: Mickael Huchet on Oct 18, 2011 1:59 PM

Hi Shabarish,
Thanks that will help to localize my search.
else by hazard, you don't know which parameter in this tree is for the "Audit Log"?
coz I did a quick look in prod and pre-prod, but it seems the severity is the same (e.g "Info" for most of them) whereas the trace level of "Audit log" is different.
Thanks for
Regards.

SAP Security audit log and Profile Parameter rsau/enable

Does the Profile Parameter rsau/enable have to ="1" for the audit log to be active or is this parameter set to purely allow the maintainance of static profiles. I have been reading into SAP's documentation and they only refer to this parameter in the "Maintaining Static Profiles" section. Therefore I would like to know if the audit log can record when the parameter rsau/enable = "0"?
Many thanks

Hi
I have it running on my NW2004s sneak peak system, whit a dynamic filter and the rsau/enable = 0. So Yes - it's possible to record in the secure audit log with rsau/enable = "0", if your using the dynamic filters
Regards
Morten Nielsen

Audit Log update using Xchange or Webservice

Hello,
We are looking for the functionality to update Audit logs for Items.
Do we have possibility to update the Audit logs for some Particular Item by using web service or Xchange message?
The idea is to update the Audit log using some external service...
Thanks in Advance,
Regards,
Pushkar

Hi Pushkar ,
I think we cannot do this . But can you please tell me in which business scenrio you want to modified the audit Log. Audit log is meant to record changes of those selected using the audit log feature in SAP ME 5.2 .
Any update with to item would anyway (Internal or External) get updated in the audit log i believe .
Thanks
Kishore K V

Content Server with File System Based Content Repository

Typically the SAP Content Server is installed with a SAPDB database. The content server software serves the content from the content repository - the SAPDB database.
I recall reading a few years ago about (unofficial?) plans from SAP to support file system based repositories, with the content server controlling access. So from a KPRO application perspective, whether the document was in a database or on a filesystem is hidden.
Can anyone tell me whether this is available yet? And if so, under Windows operating systems?
Regards
Andrew

HI Frank Weitzdörfer ,
Could you share about architecture of this scenario ?
Can I use a simple PC as content repository and keep content server and R/3 System in the same box and define some link between CS & PC based repository.
Regards
Gopal Jaiswal

How to control permissions in KM using File System Repository Manager

Hello everybody
I have a scenario with 15+ file servers which content needs to be mapped into Portal KM as read-only.
Windows Authentication is configured on the portal, so the users don't need to supply the portal with username/password.
Now the users are of course only allowed to see the same content in the portal as they can see on the file servers. I know that the permission mapping can be done using a File System Repository Manager with W2KSecurityManager, but in that case the users will have to maintain the mapping of rights from windows to portal manually. And with ever-changing passwords this is too big an administrative task. So I am looking for another solution.
My question is therefore:
How can you configure the File System Repository Manager in a way where it the user does not need to maintain "user mapping" manually, but only need to logon to the portal (through windows authentication) and can see the same files from the portal as he/she can see from the file servers.
Can this information in some way be taken from the configured Windows Authentication? Or is the only solution to enable WebDav on the file servers and and follow the "Integration of Windows File Servers into the SAP KM platform Using SSO and the WebDAV Repository Manager"-guide?
Any help will be rewarded.
Best regards,
Martin Søgaard

Hi again Dirk
I just studied the "Integration of Windows File Servers into the SAP KM platform using SSO and the WebDAV repository manager"-guide in depth and I don't quite understand what rights the cmadmin_service and notificator_service are supposed to be given in the Active Directory. In the guide it says:
"A number of global services and repository services need to perform operations on resources in various repositories. For example, the index management service must read all resources it is meant to index. When an index is created, the service user index_service is used. Therefore, this user has to have at least read access to all repositories that are to be indexed. Other users that are used by the SAP KM platform are the service users notificator_service and cmadmin_service. When a search is taking place, it is the user that is currently logged on to the portal."
I dont quite understand what the two service users are doing but more importantly, I need to give the two service users the correct permissions in the Active Directory (or through user mapping). I understand that index_service only needs read_only permissions, but what permissions should the cmadmin_service and notificator_service be given?
Best regards,
Martin

Collecting File System Audit logs with Audit Vault

Similar Messages

Maybe you are looking for