How to find out who deleted the archive logs

Hi All,
Recently some archive logs were deleted from one of our servers. Is there any way to find out which user has deleted the archive logs through OS or through database ?
OS Version :-
SunOS Generic_Virtual sun4u sparc SUNW,SPARC-Enterprise
Database Version:-
SQL*Plus: Release 9.2.0.8.0 - Production on Mon Apr 9 01:12:15 2012

888132 wrote:
Hi All,
Recently some archive logs were deleted from one of our servers. Is there any way to find out which user has deleted the archive logs through OS or through database ?
OS Version :-
SunOS Generic_Virtual sun4u sparc SUNW,SPARC-Enterprise
Database Version:-
SQL*Plus: Release 9.2.0.8.0 - Production on Mon Apr 9 01:12:15 2012As explained by others, from oracle database there is no record if they are deleted from OS.
But you can probably find the history of OS command been run with history command :). You can get the date and time.
Following link can help
http://stackoverflow.com/questions/99755/how-do-i-get-the-command-buffer-in-solaris-10
http://www.cyberciti.biz/faq/unix-linux-bash-history-display-date-time/
http://www.linuxquestions.org/questions/solaris-opensolaris-20/in-solaris-command-line-how-to-get-the-previous-commands-573814/
But i suggest you to post in Sun OS forum to get more details as its nothing to do with Database(in this scenario)

Similar Messages

How to find out who deleted the central person ID of a pernr.

Hi,
I have a pernr 100 whose central person ID is deleted. I would like to know how can i find out who deleted it. Which table gives this information.
Thanks & Regards,
Soumya.

It is stored as a relationship in HRP1001 & unless you have table logging turned on for this db table, I don't think you will be able to find out who deleted the Central Person. You can try running the Report RHCDOC_DISPLAY .
~Suresh

How to find out who deleted the standard table enteries

Hi,
Somebody has deleted entire KNA1 in one of our systems. Is there any way to find out who deleted the entries?
Thanks & Regards,
Kumaran Duraiswamy.

Hi
Look for help from an ABAPer. Go to SE11 for KNA1, use 'where-used list (ctrlshiftF3) and search for report that begin with Z* or Y* (perhaps LZ* or LY*, ie: function modules). See the ABAP coding if there is any instructions type:
DELETE kna1 FROM xxx.
Check too if the option &SAP_EDIT in tcode SE16N works in your system (see SAP Note 1420281 - CO-OM tools: SE16N: Deactivating &SAP_EDIT for instance)
I hope this helps you
Regards
Eduardo
PD: I forgot it, if option &SAP_EDIT works in SE16N, check the tables SE16N_CD_DATA and SE16N_CD_KEY.
Edited by: E_Hinojosa on Jun 24, 2011 11:04 AM

How to find out who deleted the directory in Unix

Hi Experts,
In my system some body tampered the directories, and more over some body deleted the bin directory under the /usr/sap/trans in Unix operating system. now i am checking to find out who deleted and for the more logs.
i am unable to find out the user name and deleted directory logs..i know its completely related to the unix level but mean time i am searching for the same.
Any ideas and clues will be heighly appreciated.
-Srini

To know the OS would have been helpful
First ask the people around you if anybody did it, maybe he is man enough to admit...
Try to find out who logged at the time when the directory was deleted.
- check the OS syslog (/var/adm/syslog/syslog.log for hp-ux, /var/log/messages for linux)
- try the last commando to get a list of who logged on when
- check the command histories of the sidadm, root user, use the history command, or the h alias
- check if there are scripts running, which regularly delete files
As the trans directory might be NFS mounted to other servers, you might need to do the checks there too.
Best regards, Michael

How to find out who deleted a Bank Number

Hi Guru,
How can I find out who deleted a bank number for a particular country. Thanks!
Regards,
Ajit

Hi,
Go to SCU3 transaction, enter the relevant object and you will see the logs.
Regards,
Eli

How to find out, who locked the same row

Dears,
I have a problem,
sometimes our user complain that, when he tyring to make a transaction to a specific customer's Account
its says 'Some other user access the same account, keep trying...' (like this).
and in this response I just kill that user's session. then he can make the transaction by reconnecting.
sometimes my solution(killing the session) can not slove this problem.it stayed even 5/6 hours long.
in this time,i cannot find any bloking session or such a long waiting session.
In this Scenario..
I need to find out who(SID,SERIAL#,USERNAME) locked the same ROW (not table).
There are many users who are locking different rows of the same table at the
same time. I need to find the one who locked my row.
is it possible to find out, who locked the specific customer's Account ?
I am trying to find out by the following query but failed.
SELECT s.SID, serial#, machine, osuser, terminal, b.object_name,
row_wait_obj#, row_wait_file#, row_wait_block#, row_wait_row#,
DBMS_ROWID.rowid_create (1,
row_wait_obj#,
row_wait_file#,
row_wait_block#,
row_wait_row#
) rowidd
FROM v$session s, dba_objects b
WHERE s.row_wait_obj# = b.object_id
SELECT *
FROM (SELECT s.SID, serial#, machine, osuser, terminal, b.object_name,
row_wait_obj#, row_wait_file#, row_wait_block#, row_wait_row#,
DBMS_ROWID.rowid_create (1,
row_wait_obj#,
row_wait_file#,
row_wait_block#,
row_wait_row#
) rowidd
FROM v$session s, dba_objects b
WHERE s.row_wait_obj# = b.object_id)
WHERE rowidd IN (SELECT ROWID
FROM account_mas
WHERE branch = '999' AND accout_no = '009990215454')
please help me...
My Database version- 10.2.0.4, windows
Regards
Halim
Edited by: Abdul Halim on Oct 26, 2009 2:43 AM

Just check with this query, find the lock and kill the session.
select b.session_id ,a.SERIAL#, a.username "Blocker Details"
from v$session a,dba_lock b
where b.session_id = a.sid
and b.blocking_others = 'Blocking';
Regards
Asif kabir

How to find out who was the previous owner of an iPad?

My sister has recently found an iPad 1 WiFi on a bus. To determine the actual owner she had a friend to reset the iPad to factory settings (not sure why though) and now all initial data is lost. Apple Store could not help much, as the iPad was sold by a 3rd party retailer.
Does anybody know how to determine the previous owner (Apple ID, Device name or other) after a full reset? Would Apple be able to disclose previous Apple ID associated with the device?

These links may be helpful.
How to Track and Report Stolen iPad
http://www.ipadastic.com/tutorials/how-to-track-and-report-stolen-ipad
Reporting a lost or stolen Apple product
http://support.apple.com/kb/ht2526
Report Stolen iPad Tips and iPad Theft Prevention
http://www.stolen-property.com/report-stolen-ipad.php
Best advice - Turn it in to the local police. Usually if no one claims it after a period of time, it will be yours. And your concious will be clear.
 Cheers, Tom

How to find out who made the entry or made changes to a documents?

Dear All,
As an administrator I mostly get the query as to made the entry in SAP Business One or who has made changes to the already created documents?
Can you please advice

Hi,
Check this first: Query For Sales Order Amendments
Thanks,
Gordon

How to find out who has deleted the production Query

Hi All,
I have searche SD , i can find it for infoobject deletion but i couldn't find it for Query.
Please let me know is there any possiblity to kow
How to find out who has deleted the production Query
Awaiting for your replies.
cheers

Hi Mahesh and all,
Thanks for all your inputs.
I have tried with RSRREPDIR tabel , I am unable to see that query at all.
If I use theT-code SLG1,
please guide me on the steps with paramets to be given in the respective ..object, subobject etc..
OR
could you please suggest any other way.
cheers
leena

How to find out who had deleted the function moldule? S O S

how to find out who had deleted the function moldule Thank you very much.

if this fm was assigned to device class (package) you'll find it in
tables tadir, e070, e071
try with name of function module or function group
hope that helps
Andreas

HT201441 i just bough a used iphone but looks that it was found and i cant unlock it. its still link to the last user my question is how do i find out who is the last owner so i can unlock it

i just bough a used iphone but looks that it was found and i cant unlock it. its still link to the last user my question is how do i find out who is the last owner so i can unlock it

peeweenborre wrote:
i just bough a used iphone .... its still link to the last user ...
If you cannot get this information from the seller
Removing a device from a previous owner’s account
You need to return the Device for a refund,

How to find out who has released the purchase order?

Hi All,
I have a PR number lets say 10231322 and somebody has release it. Could any one please tell me how to find out who has release it?
Waiting for your kind replies......
Thanks in advance.
Regards,
Faisal

Hi,
When you are in tr ME23N, use the menu: environment > header changes.
Rgds,
Suzy

*HOW TO DELETE THE ARCHIVE LOGS ON THE STANDBY*

HOW TO DELETE THE ARCHIVE LOGS ON THE STANDBY
I have set the RMAN CONFIGURE ARCHIVELOG DELETION POLICY TO APPLIED ON STANDBY; on my physical standby server.
My archivelog files are not deleted on standby.
I have set the CONFIGURE ARCHIVELOG DELETION POLICY TO NONE; # default on the Primary server.
I've checked the archivelogs with the FRA and they are not beign deleted on the STANDBY. Do I have to do something for the configuation to take effect? Like run a RMAN backup?
I've done a lot ofresearch and i'm getting mixed answers. Please help. Thanks in advanced.
J

Setting the Policy will not delete the Archive logs on the Standby. ( I found a thread where the Data Guard product manager says "The deletion policy on both sides will do what you want" ). However I still
like to clean them off with RMAN.
I would use RMAN to delete them so that it can use that Policy are you are protected in case of Gap, transport issue etc.
There are many ways to do this. You can simply run RMAN and have it clean out the Archive.
Example :
#!/bin/bash
# Name: db_rman_arch_standby.sh
# Purpose: Database rman backup
# Usage : db_rman_arch_standby <DBNAME>
if [ "$1" ]
then DBNAME=$1
else
echo "basename $0 : Syntax error : use . db_rman_full <DBNAME> "
exit 1
fi
. /u01/app/oracle/dba_tool/env/${DBNAME}.env
echo ${DBNAME}
MAILHEADER="Archive_cleanup_on_STANDBY_${DBNAME}"
echo "Starting RMAN..."
$ORACLE_HOME/bin/rman target / catalog <user>/<password>@<catalog> << EOF
delete noprompt ARCHIVELOG UNTIL TIME 'SYSDATE-8';
exit
EOF
echo `date`
echo
echo 'End of archive cleanup on STANDBY'
mailx -s ${MAILHEADER} $MAILTO < /tmp/rmandbarchstandby.out
# End of ScriptThis uses ( calls an ENV) so the crontab has an environment.
Example ( STANDBY.env )
ORACLE_BASE=/u01/app/oracle
ULIMIT=unlimited
ORACLE_SID=STANDBY
ORACLE_HOME=$ORACLE_BASE/product/11.2.0.2
ORA_NLS33=$ORACLE_HOME/ocommon/nls/admin/data
LD_LIBRARY_PATH=$ORACLE_HOME/lib:/lib:/usr/lib
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib
LIBPATH=$LD_LIBRARY_PATH:/usr/lib
TNS_ADMIN=$ORACLE_HOME/network/admin
PATH=$ORACLE_HOME/bin:$ORACLE_BASE/dba_tool/bin:/bin:/usr/bin:/usr/ccs/bin:/etc:/usr/sbin:/usr/ucb:$HOME/bin:/usr/bin/X11:/sbin:/usr/lbin:/GNU/bin/make:/u01/app/oracle/dba_tool/bin:/home/oracle/utils/SCRIPTS:/usr/local/bin:.
#export TERM=linux=80x25 wrong wrong wrong wrong wrong
export TERM=vt100
export ORACLE_BASE ORACLE_SID ORACLE_TERM ULIMIT
export ORACLE_HOME
export LIBPATH LD_LIBRARY_PATH ORA_NLS33
export TNS_ADMIN
export PATH
export MAILTO=?? your email hereNote use the env command in Unix to get you settings.
There are probably ten other/better ways to do this, but this works.
other options ( you decide )
Configure RMAN to purge archivelogs after applied on standby [ID 728053.1]
http://www.oracle.com/technetwork/database/features/availability/rman-dataguard-10g-wp-1-129486.pdf
Maintenance Of Archivelogs On Standby Databases [ID 464668.1]
Tip I don't care myself but in some of the other forums people seem to mind if you use all caps in the subject. They say it shouting. My take is if somebody is shouting at me I'm probably going to just move away.
Best Regards
mseberg
Edited by: mseberg on May 8, 2012 11:53 AM
Edited by: mseberg on May 8, 2012 11:56 AM

How to find out who's texting you from an iCloud email address?

how to find out who's texting you from an icloud email address?

OK after a bit of research I found a way to achieve this.
I simply looked up the email address in ADUC, then did a search in SP with the display name. I could locate the list and manually confirm it was configured with the incoming email address I was looking for.
I also found the below script on Stackoverflow, but got "The 'using' keyword is not supported in this version of the language." when I tried to run it. Any idea how to fix that? I'd like to have a script to link a library to an email address istead of the
manual approach described above.
http://stackoverflow.com/questions/4974110/sharepoint-how-do-i-find-a-mail-enabled-list-if-i-only-have-the-email
$SiteCollection = ""
$EmailAddress = "" # only the part before the @
# Load SharePoint module if not done yet
if((Get-PSSnapin | Where {$_.Name -eq "Microsoft.SharePoint.PowerShell"}) -eq $null) {Add-PSSnapin Microsoft.SharePoint.PowerShell;}
cls
using System;
using Microsoft.SharePoint;
namespace FindListByEmail
class Program
{a
static void Main(string[] args)
string siteUrl = $SiteCollection;
string email = $EmailAddress;
using (SPSite site = new SPSite(siteUrl))
foreach (SPWeb web in site.AllWebs)
try
foreach (SPList list in web.Lists)
if (list.CanReceiveEmail)
if (list.EmailAlias != null && list.EmailAlias.Equals(email, StringComparison.InvariantCultureIgnoreCase))
Console.WriteLine("The email belongs to list {0} in web {1}", list.Title, web.Url);
Console.ReadLine();
return;
finally
if (web != null)
web.Dispose();

How to delete the archive logs.

Hi,
I need to delete the archive logs in standby database which has been generated after created the restore point.
SEQUENCE# APPLIED
17 YES
18 YES
1 NO
2 NO
19 YES
18 YES
21 YES
22 YES
20 YES
23 YES
24 YES
sequence 1,2 has been generated after created the restore point,how can i remove sequence# 1 and 2 from the v$archived_log;
ways i have tried
1.dropped the restore point during that time only the flashback logs has been deleted not the archive log
2.manually tried from rman ,but i was not working.
please help me out....
***points are waiting for you guys****

Hi,
I need to delete the archive logs in standby database which has been generated after created the restore point.
SEQUENCE# APPLIED
17 YES
18 YES
1 NO
2 NO
19 YES
18 YES
21 YES
22 YES
20 YES
23 YES
24 YES
sequence 1,2 has been generated after created the restore point,how can i remove sequence# 1 and 2 from the v$archived_log;
ways i have tried
1.dropped the restore point during that time only the flashback logs has been deleted not the archive log
2.manually tried from rman ,but i was not working.
please help me out....
***points are waiting for you guys****

How to find out who deleted the archive logs

Similar Messages

Maybe you are looking for