Feature Question - Audit Logging

Hello forum. Sorry if this is the wrong thread for this topic, but I was wondering if audit logging is a Standard Edition feature or if it's Enterprise only.
I can't find anything specifically saying that it is or isn't, and it's not enabled on my database so other than trying to enabling it and getting an error message (or not) I can't find an answer.
Sorry if this is a noob question, but I couldn't find anything about whether RMAN backup encryption was a Standard or Enterprise feature either, and it bit me in the ass when I found out it was Enterprise only.
Thanks in advance...

My apologies if you think I wasn't thorough enough in my own research before asking the question. I did do my own research using oracle's docs and google, and my final resource was the 10g Oracle Database Security Guide, which mentioned nothing about which versions supported which features.
I did post my original question yesterday morning and received no response. As you said, this is a volunteer forum, and I'm grateful for the assistance, but as sad as you think it is that I asked for an answer within a time frame, I was left with no choice. The question was posed to me yesterday morning and I needed to return an answer this afternoon.
In any event, thank you for the information.

Similar Messages

Support situation of Audit Log feature

Hello,
We now make a study for migration our on premise SP2013 to online(Japan Region).
Although content be shown in URL below, a part of audit log doesn't support at this moment,
we need to get their logs.
Could we make a alternate solution to get their 3 logs below ?
"For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available."
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2

Hello,
We now make a study for migration our on premise SP2013 to online(Japan Region).
Although content be shown in URL below, a part of audit log doesn't support at this moment,
we need to get their logs.
Could we make a alternate solution to get their 3 logs below ?
"For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available."
https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-A9920C97-38C0-44F2-8BCB-4CF1E2AE22D2

ODSI 10Gr3 audit logs common/time question

Hi
With ODSI10GR3, We are investigating delays in processing of some DB2 Inserts
Inserst occur daily but th eproblem happens maybe once in a week
A review of the audit log during teh problem occurance shows the following
Comon/time is taking 33 seconds
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }
with compile time being ~ 14 sec and insert time being ~ 4 seconds
Is it possible that things such as full gc ooccuring can impact this time?
We increased tx timeout to 120 seconds to avoid the timeout but would like to investigate further on this.
Thanks Much for any info
Best
####<Mar 1, 2010 10:22:09 AM PST> <Info> <ODSI> <qa-sc-eibapp02.corp.test.com> <ds_ms2> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <service.uateibsads> <> <> <1267467729490> <BEA-000000> <ClientDataspace> <DSPAuditEvent timestamp: Mon Mar 01 10:21:36 PST 2010 severity: FAILURE id: ClientDataspace:48:Mon Mar 01 10:21:36 PST 2010 {
common/application {
user: service.uateibsads
name: ClientDataspace
eventkind: update
server: ds_ms2
query/performance {
compiletime: 14869
update/relational {
source: CBS_DB2_DS
sql: INSERT INTO "S109935E"."C@CR538"."C@CUNEW01" ("C@STATUS", "C@SEQNBR", "CUBK", "CUNBR", "CUSTAT",
"CUALT", "CUNA1", "CUNA2", "CUNA3", "CUNA4", "CUNA5", "CUNA6", "CUZIP", "CUZIP2", "CUZIP3",
"CUZIP4", "CUSHRT", "CUSSNR@", "CUSSTY", "CUCLPH", "CUHMPH", "CUBUPH", "CUPOFF", "CUSOFF",
"CUPOF1", "CUPOF2", "CUOPDT", "CUTYPE", "CUTYP", "CUSIC", "CUSEX", "CURACE", "CUOWN", "CUYREM",
"CUINC", "CUSRIN", "CUBDTE", "CUDEP", "CUCTC", "CUCTCT", "CUCIRA", "CUMNBR", "CUNTID", "CUUSR1",
"CUCLNK", "CUUSR3", "CUCDCH", "CUCDCN", "CUCDCD", "CUCMCH", "CUCMNR", "CUCMCD", "CUCVSH",
"CUCVCN", "CUCVCD", "CUCATH", "CUCATN", "CUCATD", "CUCLNG", "CUCCCD", "CULGLR", "CUCWHP",
"CUCPSP", "CUCTXN", "CUCPRF", "CUSHKY", "CUITLD", "CUPSTL", "CUACOM", "CUBRCH", "CUMIDT@",
"CUMRTS", "CUMAIL", "CUSOLI", "CUSOCI", "CUCPNA", "CUBPNA", "CUPERS", "CUSALU", "CUFAX",
"CUTELX", "CUTXAN", "CUDOCF", "CUDCDT", "CUTINU", "CUTADT@", "CUWPRT", "CUCECD", "CUCELM",
"CUEXTF", "CUMTND", "CUCNCD", "CUMARK", "CUEMPL", "CUINQ", "CUMNT", "CUCENS", "CUCODT", "CUDEDT",
"CUACCD", "CUBYR1", "CUBYR2", "CUPREF", "CUJBDT", "CUJDDT", "CUEMA1", "CUEMA2", "CUOPT",
"CUOPTD", "CUSPFG", "CUOENTTYP", "CUCENTTYP", "CUAMDT", "CUESDT", "CUENA1", "CUENA2", "CUENA3",
"CUENA4", "CUENA5", "CUENA6", "CUEPST", "CUEZIP", "CUEZIS", "CUEZP3", "CUEZP4", "CUAAPL",
"CUAAKY", "CUAREC", "CUASTA", "CUANA1", "CUANA2", "CUANA3", "CUANA4", "CUANA5", "CUANA6",
"CUAZP1", "CUAZP2", "CUAZP3", "CUAZP4", "CUAPSD", "CUASTR", "CUASTP", "CUASTS", "CUAFLG",
"CUARFG", "CUCLS", "CURISK", "CURDT1", "CURSK2", "CURDT2", "CUCRLN", "CUCRDT", "CUCRFR",
"CUCRND", "CUCRPR", "CUFSDT", "CUFSFR", "CUFSND", "CUSALE", "CUCSTS", "CUNETI", "CUPRJI",
"CUASST", "CUCURA", "CUCASH", "CUACCR", "CUMKTS", "CUREAL", "CULIFE", "CUINVN", "CUFIXA",
"CULIAB", "CUCURL", "CULTRM", "CUNETW", "CUDIRL", "CUINDL", "CUDIRT", "CUINDT", "CUREDB",
"CULCRO", "CUOTHA", "CUOTHL", "CU5WHP", "CUIWHY", "CUWHEX", "CUFILL", "CUREC1", "CUSTAD",
"CUFRN1", "CUCHIB", "CUCHID", "CUCLOB", "CUCLOD", "CUCCDD", "CUCDD1", "CUCDD2", "CUCHD1",
"CUCHD2", "CUCHP1", "CUCHP2", "CUCHP3", "CUCHP4", "CUCOL1", "CUCOL2", "CUCOL3", "CUCOL4",
"CUCCDT", "CUCCYD", "CUCTYD", "CUCIDB", "CUCDIR", "CUCIND", "CUCSEC", "CUCUNS", "CUCILD",
"CUCOPN", "CUCTOD", "CUCNON", "CUCHGO", "CUCRNB", "CUCQAG", "CUCQHU", "CUCQHI", "CUCQLO",
"CUCQDD", "CUCQDT", "CUDPD1", "CUDPD2", "CUDPD3", "CUDPDP", "CUDPD", "CUIPD", "CUUPD", "CUCAGY",
"CUCIAM", "CUCIAY", "CUCPAM", "CUCPAY", "CUCLTC", "CUCLSO", "CUUCMO", "CULCCA", "CUDRSD",
"CUFACS", "CUINDS", "CUIPDS", "CUSECS", "CUUNSS", "CUDPDS", "CUUCMS", "CUBDIR", "CUBCMO",
"CUTHR1", "CUTHR2", "CUTHR3", "CUTHR4", "CUTHR5", "CUFIV1", "CUFIV2", "CUFIV3", "CUFIV4",
"CUFIV5", "CUTEN1", "CUTEN2", "CUTEN3", "CUTEN4", "CUTEN5", "CUTWN1", "CUTWN2", "CUTWN3",
"CUTWN4", "CUTWN5", "CUTHI1", "CUTHI2", "CUTHI3", "CUTHI4", "CUTHI5", "CUSEV1@", "CUSEV2",
"CUSEV3", "CUSEV4", "CUSEV5")
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
rowsmodified: 1
time: 3655
common/application {
exception: Transaction timed out after 29 seconds
BEA1-000021E917F59C34B15A
update/service {
procedure: InsertNewCIF
arity: 1
dataservice: ld:CoreBankingSystem/LogicalServices/CreateNewCIF.ds
script: declare namespace ns0="ld:CoreBankingSystem/LogicalServices/CreateNewCIF";
declare namespace ns1="http://www.test.com/schemas/client/cbs/logical";
declare variable $__fparam0 as element(ns1:NewCIF)* external;
{ return value ns0:InsertNewCIF($__fparam0); }
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }

1) Is it possible that there is a database lock preventing the insert from being committed?
2) What does the audit look like for a successful update?
3) Notice that the "compile time" is non-zero. This indicates that the plan was not cached. Likely because it is the first time this was executed after the server was started. So not only do you have the extra query compilation time, there would also be time for loading classes and other initialization. (but 12 seconds of loading an initialization seems like a lot). Given that increasing the tx time to 120 seconds solves the problem (it does solve the problem, doesn't it?) I would say that this is the issue.
4) Given that you just started the server (right? see (3)), it's not likely this is due to GC. But you could enable gc verbose to see.

SGD 4.6 audit logging question

When using audit logging and filters, how often is a new log file automatically created? I'm interested in preserving the audit data and need to know when the file gets recreated.
Thanks.

By default, the logs are archived once a week via a crontab entry (Sunday, 0300, by default) - this option is set at install time, can be changed by running tarantella setup, or you can alter the crontab entry directly.
See "7.2.3.6 Automatic Log Archives" in the admin guide - http://docs.oracle.com/cd/E26362_01/E26354/html/sgd-installation.html#sgd-installation-full-restore and
http://docs.oracle.com/cd/E26362_01/E26354/html/tta-archive.html for a description of the archive command.
The archive command closes out the current log files, and compresses/summarizes them, and stores them in a numbered sub-directory under the "logs" directory, and opens news ones. Once closed out, you can no longer "query" the logfiles from the command line. Note that there are a limited number of archives maintained - 7 sets, I believe, is the default.
Have a look at the "archive" command under .../bin/scripts to see how it works.

Issue with Audit Log report in SharePoint 2010

I have enabled REPORTING feature at site collection level and configured the site collection audit settings. I tried to generated Audit log reports, most of the time it keeps on processing as shown in fig.It
keeps on processing, never comes to report generated successful message. how to overcome this issue?

i'm facing same issue, even when i tried to generate report for limited limited period(5 days) for a particular event(ex: delete or restore items (or) edit items).
I think, the below reference may guide you solve your issue
http://sharepoint.stackexchange.com/questions/17151/how-often-should-the-auditing-log-be-cleared-to-not-affect-performance
Sekar - Our life is short, so help others to grow
Whenever you see a reply and if you think is helpful, click "Vote As Helpful"! And whenever
you see a reply being an answer to the question of the thread, click "Mark As Answer

Audit log + manual update + specify download location

Hi all,
I'm evaluating whether we can use Java Web Start for our new product, for geographically distributed software deployment.
I've the following questions that I could not find answers in the official documentation:
- Can it support manual update? i.e. is there any way I can put a button on the application UI so that instead of checking latest version on every program start, the end-user can manually initiate software update.
- Can I extend it to support audit log? i.e. we need to keep track of which client upgrade to which version in a centralized database (as audit trail), and when such update occurred. Can we do this?
- Some of our end-user has no access to local filesystem, they only have access to dedicated shared network drive, can we customize Web Start so that it download and save the new version to a specific location, instead of C:\temp?
- We have a few jar files for the application. How can we ensure that all jar files are either updated, or not updated at all? i.e. kind of transaction concept.
- One of the jar files contains some configuration files, which need to be expanded in exploded format (to allow runtime change of configuration options). How can we do that?
Thanks a million.

Hi all,
I'm evaluating whether we can use Java Web Start for
our new product, for geographically distributed
software deployment.
I've the following questions that I could not find
answers in the official documentation:
- Can it support manual update? i.e. is there any
way I can put a button on the application UI so that
instead of checking latest version on every program
start, the end-user can manually initiate software
update.currently, no - this is a requested feature being considered for 6.0
>
- Can I extend it to support audit log? i.e. we need
to keep track of which client upgrade to which
version in a centralized database (as audit trail),
and when such update occurred. Can we do this?only by controling a servlet or jsp page that generates the jnlp file and keeps track of what requests are made for the jnlp file and the resources of the app. Java Web Start itself runs on the client machine.
>
- Some of our end-user has no access to local
filesystem, they only have access to dedicated shared
network drive, can we customize Web Start so that it
download and save the new version to a specific
location, instead of C:\temp?webstart itself only downloads into its own cache (by default on windows XP at c:\Doccuments and settings\<user name>\Application Data\Sun\java\deployment\cache\javaws
this cache location can be configured.
in version 6.0 we will have capability to disable caching, but curent version must have a cache.
>
- We have a few jar files for the application. How
can we ensure that all jar files are either updated,
or not updated at all? i.e. kind of transaction
concept.
Java web Start currently checks timestamps of all downloaded jars before launching application, and will only update all or none.
- One of the jar files contains some configuration
files, which need to be expanded in exploded format
(to allow runtime change of configuration options).
How can we do that?If you must access these resources as files, you will have to extract them using ClassLoader.getresourceAsStream(), and then write them to disk yourself.
>
Thanks a million./Andy

I cant see 'audit log report' link in my Site Collection Administration

Hi i am configuring my sharepoint 2013, i want to use the audit feature, so i follow the steps
View audit log reports
To view an audit log report:
On the Settings menu, click Site settings.
Note The Site Collection Administration section will not be available if you do not have the necessary permissions, such as by being a member of the default Site Collections Administrators group.
In the Site Collection Administration section, select
Audit log reports.
but i cant see Audit log reports at all!!!!!!
any help is much appreiated!
My server is windows server 2012 and i am not using sharepoint foundation version.

i follow the steps in you website, that is the same website i referenced.
it ask me to :
On the Settings menu, click Site settings.
In the Site Collection Administration section, select
Audit log reports.
but the question is that i can NOT find this 'Audit log reports' link to select , the question is not i can not open the file.
the items in my Site Collection Administration is:
Site Collection Administration
Recycle bin
Site collection features
Site hierarchy
Site collection audit settings
Portal site connection
Site collection app permissions
Storage Metrics
Help settings
HTML Field Security
SharePoint Designer Settings
there is no 'Audit log reports' link!

Auditing / Logging of policy updates/publishing?

Is there such a thing? Is any publishing of the policy logged anywhere?
We've had a couple of issues in last few weeks where one of our admins has pushed the wrong policy out to groups of people overwriting their proper policy and causing no end of headache's.
Is there any sort of auditing in place showing who changed policy, or what changes were made, or who pushed out what policy, when, and who to?

This is what I got:
The Management Console will show the last user that edited a particular policy (on the main screen with the list of policies). Details of what changed would have to be done through manual SQL queries.
If this is not enough (which I suspect), please enter an enhancement request in order for PM to priorize this feature accordingly for future release.
>>>
From: Daniel Spinatto<[email protected]>
To:novell.support.zenworks.endpoint-security-management
Date: 12/15/2010 3:31 pm
Subject: Re: Auditing / Logging of policy updates/publishing?
Hey Andy,
Good question. There's nothing with 4.1 that I know of.
Let me ask anyway and I'll get back to you.
>>>
From: andystewartSL<[email protected]>
To:novell.support.zenworks.endpoint-security-management
Date: 12/10/2010 6:36 am
Subject: Auditing / Logging of policy updates/publishing?
Is there such a thing? Is any publishing of the policy logged anywhere?
We've had a couple of issues in last few weeks where one of our admins
has pushed the wrong policy out to groups of people overwriting their
proper policy and causing no end of headache's.
Is there any sort of auditing in place showing who changed policy, or
what changes were made, or who pushed out what policy, when, and who to?
Andy Stewart - Somewhere In Scotland
zcm 10.2.2, 4 servers in esx vm environment, 2000 users so far...
(i'd still rather be snowboarding)
andystewartSL's Profile: http://forums.novell.com/member.php?userid=1054
View this thread: http://forums.novell.com/showthread.php?t=427867

Not able to generate "Audit Log Tampering report"

Hi,
I am not able to generate the Audit Log tampering report in version 8.0 of Sun Identity Manager. I am encountering the following message when I am trying to generate the report.
"Tamper-resistant logging is disabled. Unable to verify the integrity of the audit logs." I did not find any option to set the tamper-resistant logging feature in version 8.0 of Sun Idm.
In version 6 there is an option to set the tamper resistant audit log box by "Enabling tamper-resistant audit logs box" ( Please refer: http://docs.sun.com/source/819-4483/auditing.html)
The generated report (in version 6) did not show any data inspite of me deleting a row in the audit log.
I hope you can help me with this problem. Thanks in advance
Regards,
Sharon

1) It shouldnt matter, but try
destype=file (FILE small case)
2) In builder, in property pallette see if you have given any "initial value" for these parameters (especially desname, destype etc) ?
3) Do not give "batch=yes" in command line and try
Thanks
Ratheesh

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

BOE XI 3.1 Removing Audit log files

Hi there experts,
we have an issue with our production BOE install (3.1 SP7) whereby we have over 39,000 audit log files awaiting processing in the BOE_HOME/auditing folder. These audit files were generated a few months back when we had an issue with the system whereby thousands of scheduled events were created, we are not sure how. The removal of these events has had a knock on effect in that we have too many audit files to process, ie the system just cant process them all quickly enough.
So my question is can we just remove these audit files from the auditing directory with no knock on effects as we dont need them loading into the audit database anyways as they are all multiples of the same event.
As an aside when we upgraded from SP3 to SP7 the problem went away, ie no new audit files for these delete events being generated. We are still to establish how/why these audit events were created but for the time being we just want to be able to remove them. Unfortunately as its a production system we don't want to just take a chance and remove them without some advice first.
thanks in advance
Scott

Is your auditing running now? Or still pending? Can you check in Audit DB, what is the max(audit_timestamp? This will tell you when was the recent actvitiy happened.
Deleting the audit files, will not harm to your BO system. You will not be able to see auditing details for that period.
Is the new auditing files are processed? or you still see the files created in auditing folder without processing?
If the auditing file size shows 0 okb, than it means they were processed.

Usage Report and Audit Log report showing different totals

I am trying to understand the differences displayed in two similar reports. The first report is an 'Audit Log' Report and it is displaying the number of Resource Account creations over a time period. The second report is a Usage Report using the exact same criteria (objectType = Resource Account and Action = Create). The totals I get back are VASTLY different. Can anyone explain? Is this a known bug?

Hi,
In any report we don't show the storage policies information. In Cost report if the storage policies have different rate factors then we will show the split for the storage information. But in usage report , rate factors will not be applicable as we don''t show the cost details. Hope this clarifies your question. Please let us know if you need more information.
Thanks,
Lakshmi

Audit Log Management

I cannot get my Audit Log Management job to run. It fails because "Invalid audit archive path. Please check your setting." Where do I check the setting? I am running 5.0.3 with Collab 4.0. Thanks.

Just an FYI, with ZDM 6.5 HP3 the file name changed from AuditLog.txt to
ZRMAudit.txt still located under system32 on Windows XP.
Jim Webb
>>> On 5/22/2006 at 3:27 PM, in message
<[email protected]>,
Jim Webb<[email protected]> wrote:
> Well I found out the ZDM 6.5 HP2 fixes the problem of the log file not
> being
> created.
>
> Jim Webb
>
>>>> On 5/19/2006 at 8:37 AM, in message
> <[email protected]>,
> Jim Webb<[email protected]> wrote:
>> Well, it does show up in the event log but not in the inventory. If I
>> disable inventory the log file won't be deleted, correct?
>>
>> Jim Webb
>>
>>>>> On 5/18/2006 at 10:03 AM, in message
>> <[email protected]>, Marcus
>> Breiden<[email protected]> wrote:
>>> Jim Webb wrote:
>>>
>>>> I did a search on a machine I am remote controlling, no log file. What
>>>> next?
>>> good question... does the session show up in the eventlog?

Audit log web service for Office 365

I am working on developing an application that will interact with the Office 365 services. I am currently able to get the files and folders of a singed-in user using the OAuth2 authentication. I am aware that we can get the audit logs and it will be exported
to Microsoft Excel.
However, my question is : Is there any web service or endpoint I can use to access the logs using REST API. For example, Box provides an api/endpoint to achieve this: http://developers.box.com/docs/#events.
Any help would be highly appreciated!
Many Thanks

Currently displaying audit log reports in REST or API is not supported by Microsoft. SharePoint online in Office 365 just supports saving an audit log report as a Microsoft Excel 2012 Preview workbook.
You can refer the following post :
http://community.office365.com/en-us/f/172/t/164047.aspx

Feature Question - Audit Logging

Similar Messages

Maybe you are looking for