Content of the Audit Log
Hello,
It seems that the text of the audit log is contained in table xi_af_msg_audit ins the J2EE schema under field text_key.
If I access this key directly from the database it seems to be unnecessarily long, with a lot of blank space padding.
Is it possible to control what is recorded in this field and hence what is displayed in the Audit Log?
Kind regards,
Peter
You can simply use the AuditMessageKey class to write your own audit log entries. A similar code would be
AuditMessageKey auditMKey = new AuditMessageKey(message.getMessageId(), AuditDirection.INBOUND);
Audit.addAuditLogEntry(
auditMKey,
AuditLogStatus.SUCCESS,
"Custom Message");
Regards,
Prateek
Similar Messages
-
'Content viewing' in 'Audit Log reports' throws timout error
I have enabled 'Reports' in the site collection features and I am tryin gto generate the 'Content viewing' in 'Audit Log reports'. This keeps me waiting for a couple of minutes and throws a timeout error. Could you please let me know why is this happening
and is there any way to resolve it ?
I am getting the below error in UI and in my logging database
System.Exception
Reason: Request timed out. URL:
https://Mydomain/Mysitecollection/_layouts/RunReport.aspx/Content_viewing.xml
Thank you
Regards Rahul AHi,
According to your issue, firstly, please check if your hardware performance is poor or the site collection has numerous data, if so, improve the hardware or pull the
data out of the tables, then check the effect.
Secondly, if you cannot view audit reports for the site http://servername /sites/sitename
Try to detach and attach content database for the site you want to view, then check the effect.
Thanks,
Rock Wang
Regards, Rock Wang Microsoft Online Community Support -
An error occurred while trying to access the audit log
Hi I have run Set-Mailbox ian.shapton -AuditOwner Update, Move, MoveToDeletedItems, SoftDelete, HardDelete
I then created and deleted an email and ran Search-MailboxAuditLog -Identity "ian shapton" -LogonTypes Owner -StartDate "12/21/2014 12:00" -EndDate "12/21/2014 13:00" -ShowDetails
I see An error occurred while trying to access the audit log. For more details, see the inner exception.
+ CategoryInfo : NotSpecified: (:) [Search-MailboxAuditLog], AuditLogException
+ FullyQualifiedErrorId : [Server=Mailbox01,RequestId=07f17915-f25d-4fd5-b23e-f07a2482f4a4,TimeStamp=21/12/2014 16:45:39] [FailureCategory=Cmdlet-AuditLogException] 255D6156,Microsoft.Exchange.Management.SystemConfigurationTasks.SearchMailboxAuditLog
MSExchange CmdletLogs shows Microsoft.Exchange.Data.ApplicationLogic.AuditLogServiceException: The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired','The search operation could
not be completed within the allotted time limit. Please try to narrow down your scope to reduce the result set.'.
I am a Recipient Admin and Org Admin and can search other mailboxes using -LogonTypes Delegate
Any idea what I am missing here?
shapiHi,
I have the same problem when I run the Search-MailboxAuditLog command. It has been working for 2 weeks but suddenly after moving databases from one datacenter to another and back again it stopped working. The account running the command
is in all necessary roles needed.
This is what I have tested after it stopped working:
- Search-MailboxAuditLog -Identity "xxxxxxx" -LogonTypes Delegate -StartDate (Get-Date).Adddays(-1) = Works
- Search-MailboxAuditLog -Identity "xxxxxxx" -LogonTypes Delegate -StartDate (Get-Date).Adddays(-1) -showdetails = does not work and comes with an error.
"The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired',
'The search operation could not be completed within the allotted time limit.
Please try to narrow down your scope to reduce the result set.'."
This is very bad for us because we use a lot of shared mailboxes with delegates and want to report delegate action on these mailboxes.
Environment:
- 3 datacenters
- Exchange 2013 CU7
Thorir
thorir -
SQLException in the audit log for the Message Display Tool
Hi
I´m newbie in PI Technology, and i have some issues when i try to do the next.
This is the scenario:
I need to communicate two systems, for one side i have SAP, and for the other side i have ADI (legal system) so, i use PI to do this (the communication), PI receive the data from SAP by means abap proxy, until this everything is correct, then i do the mapping of the data and i send a message to ADI (with the SAP XI Runtime Workbench) by means JDBC adapter, if i check the sended message with "Message Display Tool" show that the message was sent (status "Delivered") but if i check the received messages option, in the audit log displays the five next errors:
Error: Could not execute statement for table/stored proc. "FADIA4" (structure "StatementFADIA4") due to java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
Error: JDBC Message processing failed, due to Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
Error: MP: exception caught with cause com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
Error: Adapter Framework caught exception: null
Error: Delivering the message to the application using connection JDBC_http://sap.com/xi/XI/System failed, due to: com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation..
if there are somebody that maybe could know what is the problem?, could the problem be the side of the legal system?, because inside of PI when i do the Test Configuration in the Integration Directory, the end of the test is successful.
Any comment is well received!!
Thanks,
Vicman
P.D. sometimes the error is: java.sql.SQLException: Token ) was not valid. Valid tokens: DAY PATH YEAR LABEL MONTH OPTION RESULT CONNECTION TRANSACTION.
what does it means?Hi Pooja,
thanks for you quickly response!
XML sended:
<?xml version="1.0" encoding="UTF-8"?>
<ns0:MT_PgDocVentaECC_req xmlns:ns0="http://gmodelo.com/ECC/enviarCobranza">
<DT_DatosDeControl>
<MIDDLEWARE_ID/>
<QUICK_ID/>
<INTERFACE_NAME/>
<MESSAGE_ID/>
<LOG_ID/>
<USER_ID/>
<SOURCE_SYSTEM/>
<TARGET_SYSTEM/>
</DT_DatosDeControl>
<DT_PagoDocVentaECC>
<VKORG>TVKO</VKORG>
<VKBUR>TVBUR</VKBUR>
<VKBUR1>TVBUR</VKBUR1>
<ROUTE>TVRO</ROUTE>
<ROUTE1>TVRO</ROUTE1>
<BLART>Q</BLART>
<BELNR>100</BELNR>
<WRBTR>200</WRBTR>
<LFART>100</LFART>
<VBELN>100</VBELN>
</DT_PagoDocVentaECC>
</ns0:MT_PgDocVentaECC_req>
this is the XML received:
<?xml version="1.0" encoding="UTF-8"?>
<ns1:MT_PgDocVentaADI_req xmlns:ns1="http://gmodelo.com/ADI/recibirCobranza">
<StatementFADIA7>
<FADIA7action="INSERT">
<Table>FADIA7</Table>
<Access>
<NUMCIA>123</NUMCIA>
<NUMALM>234</NUMALM>
<SUBALM>300</SUBALM>
<CVETOP>16</CVETOP>
<FOLOPV>22</FOLOPV>
<SECOVA></SECOVA>
<IMPOVA>200</IMPOVA>
<ALMOVA>5678</ALMOVA>
<SUBOVA>21</SUBOVA>
<TOPOVA>21</TOPOVA>
<FOPOVA>41</FOPOVA>
<FECOVA>100</FECOVA>
<STSOVA> </STSOVA>
</Access>
</FADIA7></StatementFADIA7>
</ns1:MT_PgDocVentaADI_req>
what do you think about it?, anything wrong? -
How change sStart and End Date and time in the Audit log ???
Install C2S BM39SP1. Work.
Go to the: https://bmserver:8009
Open : VPN Monitor | Audit log information.
Problem - can not cahnge Date and time in the Audit Log Start(End)
How i vcan do this ?
How i can get every day stat log:
login ; date_time_login ; dtae_timie_logout ; bite_in ; bite_out
SergSerg,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/ -
Attribute Encryption in the Audit log
All,
I am encrypting attributes so sensitive data is encyrpted at rest. Found out that the audit log doesn't encrypt these attributes. It encrypts userpassword, but not these. Is there a setting or configuration I can extend that will encrypt these attributes in the audit file?
And if there is, what happens if I need to expand the list of encrypted attributes.
I am currently running v 6.3.x, and in process of upgrading to ODSEE 11g.x
FrankHello,
as far as I can understand, I'm afraid that what you're trying to accomplish is not possible, since attribute encryption is something that happens 'within the Directory Server instance, between the protocol and the DB'... so the informations are sent in clear over the protocol, and this is what the audit log captures. According to the official product documentation:
http://docs.oracle.com/cd/E19261-01/820-2763/bcaeg/index.html
"Attribute encryption protects sensitive data while it is stored in the directory. Attribute encryption allows you to specify that certain attributes of an entry are stored in an encrypted format. This prevents data from being readable while stored in database files, backup files, and exported LDIF files.
With this feature, attribute values are encrypted before they are stored in the Directory Server database, and decrypted back to their original value before being returned to the client. You must use access controls to prevent clients from accessing such attributes without permission, and SSL to encrypt the attribute values when in transit between the client and Directory Server."
HTH,
Marco -
Why Don't I See Any Content in the FTP Log?
I am having trouble uploading files to my production server at Valcato Hosting. (I have done this many times before without any problem.) I was able to get a screen shot of a message that flashed on the screen when the uploading of files was aborted -- the message said, "4 files skipped". There was nothing at all written to the FTP log that appears at the bottom of my (Classic) Dreamweaver GUI. It is empty.
Can someone please tell me if I need to do something in order to see the content of the FTP log?
Here is a link that I found on the Adobe website that certainly implies to me that whenever one uploads or downloads files, the FTP log will show the result of each movement.
Checking the FTP log
Thank you for any help with this.Right-click on one of the other panel headings in the library module such as Folders, and make sure there is a checkmark in collections.
-
Same Application Error - while checking the auditing log report in site settings
dear all,
I am getting application error - when I am checking the audit log report from
Site Settings ->Audit log->Run a custom report ->In the save location - when I click browse button.
Any inputs to solve the issue will be helpful?
Cheers
SathyaHi,
Try to configure audit settings for a site collection as the link below:
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-f5a346d0-ee0f-4412-a5e6-d9b5abaa1012
Or check the blogs below:
http://sharepointthomas.blogspot.com/2011/07/how-to-enable-audit-functionality-in.html
http://www.codeproject.com/Articles/431342/Auditing-A-Built-in-Feature-of-SharePoint
Did you check the ULS log?
Best Regards,
Dennis Guo
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected] -
Hi folks!
I'm setting up a workflow that grants a role to a user that includes a basic approval.
The audit log for the workflow only seems to include the reason given when approving or declining the role. For my client's purposes, both the reason for wanting the role and the final decision need to be recorded.
My thought is that I can prepend the initial request reason (Which we have already transferred to a temporary attribute) to the final Reason (MX_REASON I believe) however I'm not sure when I can slip this into the workflow.
Has anyone done something similar to this before or have any ideas about another methodology?
For various reasons we need to keep with the basic approval.
Thanks,
Mattif in your env. DBA's also have access to OS files ( note oracle does not require that ), maybe you need to consider writing a cron job to keep polling from OS/DB audit trail and send it over to some remote archive.
Technically, the separation of duty is not fully in place because DBA could easily turn off auditing. you have to trust somebody to do the auditing. eventually the UNIX root user owns the machine and can even install a rogue oracle executable if the person is determined. -
How can Oracle be set up to protect against tampering with the audit log from a user with DBA privileges?
if in your env. DBA's also have access to OS files ( note oracle does not require that ), maybe you need to consider writing a cron job to keep polling from OS/DB audit trail and send it over to some remote archive.
Technically, the separation of duty is not fully in place because DBA could easily turn off auditing. you have to trust somebody to do the auditing. eventually the UNIX root user owns the machine and can even install a rogue oracle executable if the person is determined. -
Hi,
I would like to know the "lastsucessfullogindate" for portal users.
I cam across that that this is present in the UME API's
but this method is deprecated.
does this information also comes in the security audit logs.
If yes then how should be auditng be done.
Regards
ManojHi Manoj,
well sort of, you can look up, when a certain person did log in. The last log in then is the date you are looking for. There is however no log saying User X last successful log in at ....
The info what is getting logged can be found <a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/03/37dc4c25e4344db2935f0d502af295/frameset.htm">in the docs</a>.
The location of the log files is also described <a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/a0/58db515b95b64181ef0552dc1f5c50/frameset.htm">in the docs</a>.
regards,
Patrick -
Getting From unity the audit log configurations
Hi,
I am trying to get from unity the configurations regarding audit log
if it enabled or purge enabled, number of files or file sizes ....
Anybody have an idea?
thanksHi,
I am trying to get from unity the configurations regarding audit log
if it enabled or purge enabled, number of files or file sizes ....
Anybody have an idea?
thanks -
SPAuditQuery wssQuery = new SPAuditQuery(SPContext.Current.Web.Site);
wssQuery.RestrictToUser(SPContext.Current.Web.CurrentUser.ID);
wssQuery.AddEventRestriction(SPAuditEventType.View);
wssQuery.RestrictToList(list)
//set the query date range
wssQuery.SetRangeEnd(DateTime.Now);
wssQuery.SetRangeStart(DateTime.Now.AddMinutes(-30));// To get the last 30 Mins of data
SPContext.Current.Web.Site.Audit.Update();
SPContext.Current.Web.Update();
SPAuditEntryCollection auditCol = SPContext.Current.Web.Site.Audit.GetEntries(wssQuery);From your response, I understood that, The coding is okay. So no need to change the code.
I am not sure what/How to be validated the Lag. Can you please suggest more on detail ?
One more thing observed based on the below steps
1. Downloaded 3 documents sequentially
2. Gave pause for 15 seconds
3. Downloaded next 2 documents sequentially
4. Executed my above mentioned program
Result : Fetched only first 3 documents, documents which are downloaded after pause is not retrieved
5. Generated the custom report (or ) Do new Download
Result : I can See 5 Documents (In case of 5th step is new download, I can See 5 Documents instead of 6 documents)
6: Executed my above mentioned program
Result : I can See 5 Documents (In case of 5th step is new download, I can See 5 Documents instead of 6 documents)
Conclusion: Most recent download event is pushed by other relevant(Custom Report Generation or Download or Page Refresh) event
Am i Missing anything to obtain the proper result ? -
Audit Log Report not display and error is "Report Contents No data"
Dear All,
i have reuired the audit log report but when i am click the Site Action->Site Setting->Audit log reports->Run a custom report-> select the day and option and click ok the i have received the error
Please help me please check below screen shotCan you please confirm that you have configured events to audit?
Configure
audit settings for a site collection
Here is step by step how to configure audit setting.
http://anthony-verschraegen.blogspot.ca/2013/04/sharepoint-2013-configuring-audit.html
Amit -
Problem with the XI-Audit log entries in the table "XI_AF_MSG_AUDIT"
Hi,
I have an async-szenarios for PO:
We send Idoc's from SAP ERP to a WebService via SOAP. And we take Ack's. We use Integrationsprocess with deadline block to catche the errors after the retrying (three times) and to send they via e-mail.
Our problem is, the number of the audit logs in the table "XI_AF_MSG_AUDIT":
In the RTW only we see one audit log (with three retries) in an error case. But in the table XI_AF_MSG_AUDIT there are about 76 entries for the same audit log in the error case and about 20 entries in the case of the succuessfull processing.
This number of the entries in the table causes problem with the size of the redo log file and delete job of cours the large size of the table and therefore problem on the data base. The table can not be controlled. The delete job can not run and cancels every time due this redo log problems
What can cause that?
How can it be prevented, that so much entries are not be made in the table "XI_AF_MSG_AUDIT".
Best regards
GueltekinHi Gueltekin,
I am only aware of the general property auditLogEnabled of J2EE Engine Service SAP XI AF Core, which controls in general (default = true) that entries in the AF Message Audit log are written at all.
(see [http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm|http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm])
I assume that your scenarios in the error case is sending up to three messages and for each message the number of audit log infos are created. You might want to check the detailed entries in the log and see from where they are comming, you might use customer modules etc. as well.
Best regards,
Silvia
Maybe you are looking for
-
When I try to print, I get a message to save file as *.xps file, but Mozilla stops responding when I try that. Can still print from other browsers.
-
How to create a Psychedelic Promotional Video editing in Final Cut Pro 7
Hey! How are you guys? Listen I have a new client and he wants a psychedelic feel to his video. He wants bright colors and all that crazy stuff. Any ideas on how to make this look crazy? I was thinking maybe some time lapsing forward and backwards ba
-
What is needed to use iPhone 5 musicdock with iPhone 4S and getting iPhone 4S battery charged. Any adapter yet?
-
ALV grid: up and down label in column.
Hi all, i hope there is someone that can help me. My question is: is possible to have an up label and a down label for each columns in ALV grid? For example, i'm try to realize the same function of Excel that allows me to join cells. Thanks a lots, A
-
Hi Experts, Does any one implemented ANSI 820 US ACH Tax Payments outbound interface. I am looking for SAP field mappings or process. Any help on this top greatly appreciated. Regards, Harish