Fine Grained Auditing FGA - Which procedure or package caused the DML ?

Hi All,
I'm using FGA at column level. I'm trying to figure out all PL/SQL Subprograms like procedures, functions, packages, etc, which issued the SQL_TEXT in the dba_fga_audit_trail view.
e.g.
begin
sys.dbms_fga.add_policy(
object_schema => 'SCOTT',
object_name => 'EMP',
policy_name => 'SCOTT_EMP_POLICY',
audit_condition => null,
audit_column => 'SALARY',
statement_types => 'UPDATE');
end;
The dba_fga_audit_trail view successfully displays all Update Statements in the SQL_TEXT column. However, as to which PL/SQL Subprogram it was issued from - this I don't know.
Is there any way to determine this? Maybe through another system view?
I tried replacing the SQL_TEXT with a lot of '%' for every space and every bind variable characters, so that I can do a LIKE in the DBA_SOURCE view, . . . but this didn't 100% worked.
Many Thanks,
Henry Wu

Hi,
Personnally i've never seen an automatic way for doing this...
What you cando (but it can be very fastidious) is to declare constants (or IDs) for your differents package/procedure/function names and add them to your different DMLs commands.
procedure TheProc is
CurrentProc constant varchar2(100):='TheProc';
begin
update mytable set .... , proc_name=CurrentProc
end;this is an old post but it might interrest you:
Get current procedure

Similar Messages

  • Fine Grained Audit records to syslog

    Hello experts,
    I am working on Standard Auditing and Fine Grained Auditing on 11.2.0.3 databases on Red Hat x86_64.
    I am trying to send Fine Grained Audit records to syslog as for my Standard Audit records with audit_trail set to OS, but can't find any appropriate option.
    When I create FGA policies with the ADD_POLICY procedure of the DBMS_FGA package, the audit_trail parameter can only be set to DB or XML, as stated in [PL/SQL Packages and Types Reference|http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_fga.htm#CDEIECAG].
    Does somebody know if it is possible to send FGA audit records to syslog directly:
    1. without using any additional product (e.g. Oracle Audit Vault)?
    2. without doing manual extraction from fga_log$ or DBA_COMMON_AUDIT_TRAIL?
    Thanks for any suggestion.

    Hi,
    Well, i did not used FGA yet.
    I used audit_Trail=db and the query SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail WHERE to_char(extended_timestamp, 'DD/MM/RR') = to_char(SYSDATE - 1, 'DD/MM/RR') ORDER BY timestamp)
    Then i wrote a procedure, and exported the results using utl_file .
    And i scheduled this procedure to run daily.
    It works pretty good, if you like the solution as ask for details.
    Hope that helps,
    Regards.

  • Should I use the fine-grained auditing?

    I need to record the changes (of data) made to serveral tables by users. For example, I have to check the before and after images of the changes and what kind of transactions they do to cause the changes. Sould I program the logging procedure in the application or should I use the fine-grained auditing function of oracle to do it. I am not sure what this built-in function can do for me. Can anyone give me some advice on this? Thks.
    A beginner

    Why Fine-Grained Auditing?
    You may want to check standard auditing if it is suitable for you
    http://download.oracle.com/docs/cd/B19306_01/network.102/b14266/cfgaudit.htm#BABCFIHB
    I don't think you can get pre and post update values of the affected data with Auditing.
    FGA is useful when you want to audit just a "subset" of the data in the table.
    (for instance, audit everyone that wants to get all records from EMP table where SALARY > 100000)
    Message was edited by:
    tekicora

  • Fine-grained auditing

    Is there any way to audit more than one table using fine-grained auditing in oracle 10.2.0.
    Thnks in advance.

    sonidba wrote:
    Is there any way to audit more than one table using fine-grained auditing in oracle 10.2.0.
    Thnks in advance.Read this
    Re: use multiple tables in FGA Add_policy?

  • How to know if Fine Grain Auditing is used

    I have to migrate a exsisting database to a new plattaform.The old database is a Enterprise Edition and the new must be a Standard  Edition.
    But first I must make sure that none of the functions of the Enterpise edition is being used.
    How I can know if the database is using the Fine Grain Auditing?
    thanks

    Thank you. Furthermore you can find a lot of resource about it.
    Regards
    http://www.oracle.com/technetwork/database/security/index-083815.html

  • DBA_DEPENDENCIES: 11gR2 fine-grained dependency tracking -- which columns??

    DBA_DEPENDENCIES is great, but I need to know the dependent columns. Given that 11g supports fine-grained dependency tracking... for example:
    create view emp_view as
    select emp_no, emp_name
    from employees
    where emp_no in (select emp_no from employees where hire_date > sysdate-2000)
    EMP_VIEW only exposes EMP_NO and EMP_NAME.
    If I drop the column EMPLOYEES.HIRE_DATE, Oracle will not invalidate objects that reference just EMP_NO and EMP_NAME, but in this case Oracle immediately invalidates EMP_VIEW because the view definition contains HIRE_DATE.
    Where does Oracle store this column dependency? Only at the table/view/function level in DBA_DEPENDENCIES. Maybe in an X$ table somewhere?
    Or does Oracle do an "on the fly" check for the dropped column in all dependent objects (seems messy).
    Before I change any table or view, I want to know what else I may have to change without finding out the hard way. I can easily look at the view's column list, but if I have to go into the view text, or the function text... messy! Must be a better way.
    Thanks.
    BB

    Exactly what I needed. Not sure why I didn't find this with the ten different Google searches I did...

  • Fine grained auditing on table, but I don't want it on view

    I have a table which contains sensitive information, and I want to audit all queries on it except the web account 'EJBUSER', so I created the below policy:
    begin
    dbms_fga.add_policy( policy_name => 'STAFF_LOGON_QRY_POLICY'',
    object_schema => 'CPY',
    object_name => 'STAFF_LOGON',
    statement_types => 'SELECT',
    audit_condition => 'SYS_CONTEXT(''USERENV'',''SESSION_USER'') != ''EJBUSER'' ');
    end;
    This does exactly what I want, but I also have a view off this STAFF_LOGON table (below) which users can query to see their own details.
    create or replace view CPY.V_STAFF_LOGON
    as
    select * from cpy.staff_logon
    where user_name = user;
    When a user queries this view, it also writes an entry to the dba_fga_audit_trail, but I only want to see queries against the base table, not the view.
    Is it possible to fga audit the base table only, and not the view?
    Edited by: stuartu on Feb 17, 2010 11:36 AM
    Edited by: stuartu on Feb 17, 2010 12:01 PM

    But does this delete the whole account from the cloud, or just from my device. I must make sure my husband doesn't loose all his business contacts which are in the iCloud device. Thanks.

  • I cannot get Facebook to load. All other sites work fine. It will load if I disable all add-ons, but I have been unsucesssful determining which add-on is causing the problem.

    I can get FB to load without problems in other browsers.

    DFC wrote:
    To whom it May Concern
    Wow so dramatic, sorry that just seemed an odd way to start a message.  I would first recommend trying to perform a system restore.  This hardly ever fixes any thing, but it is the easiest thing to try.  Go the start menu >> All Programs >> Accessories >> System Tools >> System Restore.  Then choose the date that is before the system started acting weird.
    If that doesn't help yeah try a repair install of LabVIEW on what ever versions are acting funny.
    Unofficial Forum Rules and Guidelines - Hooovahh - LabVIEW Overlord
    If 10 out of 10 experts in any field say something is bad, you should probably take their opinion seriously.

  • After yesterday installing the latest itunes upgrade 11.1.5.5 my CD drive is no longer recognized. I do not have the file afs.sys on my computer which is supposed to cause the problem. Any ideas?

    I yesterday installed the latest itunes upgrade to version 11.1.5.5. After doing so my computer no longer recognizes my cd drive Device manager states that windows cannot load the device driver, the device driver may be corrupted or missing. When I have tried to renew the driver it states the latest one is installed. I do not have the file afs.sys on my computer which is quoted as the file which causes optical drives to disappear. Any ideas

    Hi, I've managed to get my CD & ipod working now but it wasn't easy. Maybe this will help you fix it.
    This is what I did:
    The problem: OS Windows 8.1  - was working ok with itunes (not sure which version). Upgraded to 11.1.5.5 and my old ipod stopped being recognised by itunes. As I had just bought a new ipod touch 5G I didn't pay too much attention however I soon realised that the new ipod wasn't recognised either. I uninstalled iTunes & reinstalled but that didn't fix it. I found a technote (see below) that says how to get get your ipod reconised. That worked but on a a reboot I realised that there was no CD drive appearing in windows.
    It now works & this is what I did to fix it:
    Went through the apple technotes on CD issues & looked a the Gear website
    Looked for afs.sys file but didn't have that
    The registry settings for device filters looked the same as the technotes
    Device manager for CD said there were problems in the registry
    I backed up the itunes folder (I was planning on a clean install & rebuilding itunes from scratch however most people want to keep their data)
    I uninstalled itunes but that made no difference
    I rolled back to the a system restore point that had been created not long before the upgrade to 11.1.5.5
    The CD drive was now OK again
    I went into Windows update and ran the updates that were available - one was for intel chipsets
    I created a system restore point as a precaution
    I found the registry key that is mentioned in the technotes to do with CD problems and device filters and backed it up separately as a precaution
    I ran itunes (x64) 11.1.5.5
    itunes asked me if I wanted to repair or uninstall - I uninstalled
    I rebooted
    I ran install for itunes 11.1.5.5
    itunes installed ok & the CD was still there
    ipods were not recognised
    I followed the instructions http://support.apple.com/kb/TS1538 to update the driver
    5. Verify that the Apple Mobile Device USB Driver is installed - For Windows Vista, Windows 7, and Windows 8
    Update the Apple Mobile Device Driver
    I now have a CD drive & iTunes recognises my ipod again - phew
    Good luck

  • SCOM event ID 2115 - how can we check which which monitors or rules caused the issue

    A Bind Data Source in Management Group XXX has posted items to the workflow, but has not received a response in 8220 seconds.  This indicates a performance or functional problem with the workflow.
     Workflow Id : Microsoft.SystemCenter.CollectDiscoveryData
     Instance    : XXX
     Instance Id : {FB2DDD17-A942-4D7E-1EA6-09A5351CAB07}
    A Bind Data Source in Management Group XXX has posted items to the workflow, but has not received a response in 8220 seconds.  This indicates a performance or functional problem with the workflow.
     Workflow Id : Microsoft.SystemCenter.CollectPerformanceData
     Instance    : XXX
     Instance Id : {FB2DDD17-A942-4D7E-1EA6-09A5351CAB07}
    A Bind Data Source in Management Group XXX has posted items to the workflow, but has not received a response in 7980 seconds.  This indicates a performance or functional problem with the workflow.
     Workflow Id : Microsoft.SystemCenter.CollectDiscoveryData
     Instance    : XXX
     Instance Id : {FB2DDD17-A942-4D7E-1EA6-09A5351CAB07}

    Hi
    Please refer below link for this issue
    https://support2.microsoft.com/kb/2681388?wa=wsignin1.0
    http://blogs.technet.com/b/kevinholman/archive/2008/04/21/event-id-2115-a-bind-data-source-in-management-group.aspx
    http://blogs.technet.com/b/momteam/archive/2012/04/17/kb-how-to-troubleshoot-event-id-2115-in-operations-manager.aspx
    you can find the object name for GID using powershell and sql query on operation manager :
    Powershell :
    (Get-MonitoringObject -id ‘GUID′).DisplayName
    sql query :
    Select * from BaseManagedEntity where BaseManagedEntityID = ‘GUID‘
    Regards
    sridhar v

  • Error in using fibne grained auditing

    Hello,
    I am trying to implement fine grained auditing on SAL column of my Employees table as I suspect that someone is updating values.
    I am using the system user to implement this. But when I try to use the following syntax I am getting an error "ORA-00900: invalid SQL statement"
    EXEC DBMS_FGA.ADD_POLICY(object_schema =>'hr',object_name =>'employees',policy_name =>'chk_pol',audit_condition =>'1=1',audit_column=>'salary');
    Can anyone help me out in correcting this error.
    Regards,
    Faiz Qureshi
    Email : [email protected]

    begin
    dbms_fga.add_policy
    (object_schema => 'scott',
    object_name => 'emp',
    policy_name => 'chk_pol',
    audit_condition => '1=1',
    audit_column => 'sal');
    end;
    SQL> /
    PL/SQL procedure successfully completed.
    *I used sal column and emp as a table name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

  • Location of the procedure/package in the database for forms

    Hello,
    Does anyone know where the procedure or package in the Database is that controls the parameters in a form?
    Thanks,
    Lindsay

    We are running Portal 3.0.9 and want to customizae the form that Portal gives you
    to enter the report parameters. For example, after you register a report with
    portal and want to run it, a parameter form comes up with the List Of Values for
    that report as wellas the other required parameters for running the report. The
    only trouble with the parameter form that they give you is that there is no way to
    organizae the ordering of the parameters nor is there any way to present a user
    with a better description (even an example of deisred input) of the values they
    should enter. We thought that by looking at the procedure that builds this
    parameter form, we might find clues to customizing how the parameter form is
    presented to the user.
    We are thinking that we will need to run all of our reports from a Form developed
    in Forms 6i, but since we have 125+ reports that would need to be run from a form,
    we want to explore all our options first.
    On a side note - does anyone know how you can run reports from forms (developed in
    Forms 6i) so that the report will show up in the reports server queue manager (ie
    the rw_server_queue table)? We have developed forms which run reports, but it
    seems from Oracles's documentation that Forms simply calls the local reports
    runtime (possibly rwrun60.exe??) and so the job never makes it to the queue.

  • Designing principle of auditing the DML on a specific table?

    Hi All,
    What is the designing principle of auditing the DML performed on a table? or a bunch of tables?
    I know Oracle provides the auditing capability and there is Fine-Grained auditing available to use to keep track of row/column level changes.
    However, in this case, since we want to keep all the changing history of the table, and we want to do it our own way, we don`t want to use the Oracle`s FGA.
    the scenario is:
    I have a table with 40 columns, and any one of them might be updated, including the primary key. (it sucks and bad)
    we want to keep track of all the changes performed on this table, mainly DML.
    the table structure I came up with is as below and it doesn`t look good or feel right.
    So, could you share some experiences of how your design the table in this scenario? and the basic principle or rule to follow?
    CREATE TABLE TBS (COL1 VARCHAR2(10), COL2 VARCHAR2(20), COL3 VARCHAR2(20), COL4 VARCHAR2(30)....., COL40 VARCHAR2(50));
    CREATE TABLE tbs_audit (
    SEQ_NUM NUMBER,
    USER_NAME VARCHAR2(50),
    UPD_DT TIMESTAMP,
    OPERATION_TYPE VARCHAR2(20),
    COL1_OLD_VAL VARCHAR2(10),
    COL2_OLD_VAL VARCHAR2(20),
    COL40_OLD_VAL VARCHAR2(50));Thanks in advance!

    I would definitely put the auditing records into another table.
    What I am struggling with is:
    whether should I record the changed columns only or the whole row? to me, the first one is better. it saves space, and it comes easy when I want to display the changed history of certain columns.
    And for the first one, should I use table structure like 1) or 2)? which one is better? why?
    1)
    CREATE TABLE tbs_audit (
    SEQ_NUM NUMBER,
    USER_NAME VARCHAR2(50),
    UPD_DT TIMESTAMP,
    OPERATION_TYPE VARCHAR2(20),
    COL1_OLD_VAL VARCHAR2(10),
    COL2_OLD_VAL VARCHAR2(20),
    COL40_OLD_VAL VARCHAR2(50));
    2)
    CREATE TABLE tbs_audit (
    SEQ_NUM NUMBER,
    USER_NAME VARCHAR2(50),
    UPD_DT TIMESTAMP,
    OPERATION_TYPE VARCHAR2(20),
    COL_name VARCHAR2(10),
    COL_OLD_VAL VARCHAR2(20)
    );

  • How to Identify which Source Row is causing a slowdown in the Indexing?

    Every so often the Indexing seems to hit a wall and we gaet a huge backlog of text files that need to be indexed. We get about 2 to 3 million files per day. Most of the time the problem gets resolved when we increase the degree parallel. How can we identify which text file is causing the problem?
    Regards

    I wonder if the problem is becuse of some bug when the DR$PENDING gets to zero rows. Apparently this causes the query on CTX_USER_PENDING to take a long time. I use that view to determine the partitions to pass to SYNC_INDEX procedure.
    select
    pnd_partition_name
    ,count(*)
    from ctx_user_pending
    where pnd_index_name = '<index_name>'
    group by
    pnd_partition_name
    /This takes about 5 seconds for tow rows with 335 and 13 rows.
    Tables DR$INDEX, DR$INDEX_PARTITION and DR$PENDING have had Statistics gathered
    This query has taken over 45 minutes.

  • Form debugging - Which line is causing the error?

    I have a form that I'm working on, and when I run the form like normal, just as the end user would, I keep getting an error, "FRM-41039: Invalid Alert ID 0." I can't figure out where this error is coming from in my code. It seems that it must have something to do with timing, because in trying to track down the error, when I run the form in debug mode, obviously the timing is slower as I go line-by-line in the code to see which line may be causing the error, but when I do that, I don't get the same error. I'm not close to being an expert when it comes to design-time debugging in forms, and I was wondering if someone with more experience could point me in the right direction. Is there any way that I can somehow determine which line of code is causing this error to raise? If I could identify the line of code, I could maybe find out which alert it's looking for, right? Then I could maybe narrow down the problem a bit more. Anyone have any ideas? Thanks in advance.
    YEX
    <)))><

    Like it says :"FRM-41039: Invalid Alert ID 0." Alert does not exist. So try to find line in your code which contain something like:
    Show_Alert("<name of alert>")
    Or Alert with this name dows not exist or you are misspelling the name of existing Alert.

Maybe you are looking for