How to find SQL statement = Database Auditing

Dear All
I have configured Database Auditing on Oracle 9i Enterprise Edition Server
parameter init.ora file:
AUDIT_TRAIL = "DB"
I want to audit INSERT,UPDATE, DELETE STATEMENT on PRACTICE.EMP table
for which i did :
1) Logged in as SYS
SQL> AUDIT INSERT,UPDATE,DELETE
ON PRACTICE.EMP
BY ACCESS
WHENEVER SUCCESSFUL
Audit Succedded
2) Now I have to check the SQL statement that did insert update or delete operation using SYS.AUD$
3) There is SQLTEXT field , datatype is CLOB.
How should I check the SQL Statements that were fired on PRACTICE.EMP table
Kindly help

SQL> show user
USER is "SYS"
SQL> alter system set audit_trail = db,extended scope=spfile;
alter system set audit_trail = db,extended scope=spfile
ERROR at line 1:
ORA-32001: write to SPFILE requested but no SPFILE specified at startup
I have init.ora but no spifle so should I create SPFILE based on INIT.ORA and then give the command ?
As of now I am using V$SQL view to find all the commands executed on my database.
I found one good book "Oracle Security" OREILY PUBLICATION in which Auditing Database is discussed in good details.
Thank you so much for all your efforts

Similar Messages

  • How to find sql statement with Unix process pid

    Hi
    how to find sql statement with Unix process pid
    is there any view to find that.
    please if so let me know
    Thanks in advance

    this is how I am doing this:
    oracle 7352340 7459066 0 07:47:10 - 0:00 oracleJDERED (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
    oracle 7459066 5386396 2 07:47:10 pts/1 0:01 sqlplus
    select sid,serial# from v$session where process='7459066';
    SID SERIAL#
    2178 6067
    select sql_text
    from
    v$sqlarea a,
    v$session b
    where a.hash_value = b.sql_hash_value
    and b.sid = 2178
    ;

  • How to find SQL Statement fired using SYS.AUD$ - Database Auditing

    Dear Friends
    I am having Oracle 9i Database and have configured it with database auditing option by setting the following parameter in init.ora file
    AUDIT_TRAIL = "DB"
    I want to audit SELECT, INSERT , UPDATE and DELETE operations on PRACTICE.EMP table for which I did :
    1) Logged in as SYS
    2) SQL> AUDIT SELECT, INSERT, UPDATE, DELETE
    ON PRACTICE.EMP
    BY ACCESS
    WHENEVER SUCCESSFUL;
    Audit Succedded
    Now how should I find out the SQL statement that does the insert, update or delete operation on the EMP table using SYS.AUD$ table
    Thanks

    Hi,
    It's contents can be viewed directly or via the following views:
    * DBA_AUDIT_EXISTS
    * DBA_AUDIT_OBJECT
    * DBA_AUDIT_SESSION
    * DBA_AUDIT_STATEMENT
    * DBA_AUDIT_TRAIL
    * DBA_OBJ_AUDIT_OPTS
    * DBA_PRIV_AUDIT_OPTS
    * DBA_STMT_AUDIT_OPTS
    The audit trail contains a lot of data, but the following are most likely to be of interest:
    * Username : Oracle Username.
    * Terminal : Machine that the user performed the action from.
    * Timestamp : When the action occured.
    * Object Owner : The owner of the object that was interacted with.
    * Object Name : The name of the object that was interacted with.
    * Action Name : The action that occured against the object. (INSERT, UPDATE, DELETE, SELECT, EXECUTE)
    So, take a look at action_name column from DBA_AUDIT_TRAIL view.
    Cheers
    Legatti

  • How to find sql statement which generates LOCK

    Hello,
    In my plsql procedure i have used SELECT FOR UPDATE NO WAIT statement to avoid the current record used by another user.
    Actually i want to find which sqlquery is locking the Object other than my procedure.
    I can find the session id which is locking the object but i can not able to find sql text.
    How to find the SQL text from particular LOCKING Session id as v$sql or v$sqltext or v$sqlarea dont have session id?
    Any help can be appreciated.
    Thanks in advance.

    It's not necessarily that easy to find the statement that was responsible for the lock.
    It depends.
    First of all, it depends on version.
    If you're >= 10g and you're lucky and you're licensed for Diagnostic Pack, you might find it in ASH.
    If the statement that's responsible for the lock is also waiting on something else or runs for long enough, then ASH will almost certainly have it.
    Doug Burns has a 10-part series on the subject.
    http://oracledoug.com/serendipity/index.php?/archives/1477-Diagnosing-Locking-Problems-using-ASH-Part-1.html

  • How to find SQL Statements for BW queries ?

    Experts,
    Is there a way, we can see what SQL statement BW queries creates ?
    please Help.

    Hi,
    use sql trace: transaction ST05.
    ask your database admin. He can control the database session.
    => for oracle: you can see the session also in the sap gui.
    Sven

  • How to find whether remote database is up or not (connected via dblink)

    Hi,
    I am using dblink to connect Biz database from Dev database.(Biz, Dev - database names)
    Running dbms job using the dblink from the Dev database to update data on Biz database...
    Problem is dbms job should run if and only if the Biz database is up for which i created the dblink...
    1) How to make sure or implement the check to find whether the Biz is database is up or not in Pl/sql or sql...
    2) How to reschedule the dbms jobs once the database is up
    pls suggest me how to find whether the database is up or not b4 running the dbms job?
    Using- Oracle 10g

    The only way to know whether the remote database is up (and whether the network between the two databases is up and whether the remote database's listener is up and whether the password configured in the database link is correct and whether the local TNS alias is correct, etc) would be to actually run a query against the remote database over the database link. In other words, the way to figure out whether the link is up is to let the job run and catch & handle exceptions when there are problems.
    By default, a job scheduled via DBMS_JOB will automatically reschedule itself if there is an unhandled exception by geometrically backing off (it waits 1 minute after the first failure, 2 minutes after the second, 4, 8, 16, 32 minutes, etc until it's marked as broken after 16 failures). You could, of course, catch appropriate exceptions and handle them in a reasonable fashion and manually reschedule jobs at intervals that make more sense for your particular job.
    Justin

  • How to Capture  sql statement

    we have 1 server oracle and many clients.
    when client sends sql statement to server.How to Capture sql statement to analysis berfore it sent to server and execution.
    Edited by: 955185 on Aug 27, 2012 4:22 AM

    955185 wrote:
    yes. how to do this?Check these link all of them talking about Already executed sql in database by Users , but i don't know if what you ask is possible since they already connect to database
    If you attending to analysis sql read the below links and start your analysis,
    Last executed sql
    http://www.databasejournal.com/features/oracle/article.php/3373701/Watching-SQL-Execute-on-Oracle---Part-I.htm
    http://stackoverflow.com/questions/55899/how-to-see-the-actual-oracle-sql-statement-that-is-being-executed

  • How to find sql server backup was taken under compression mode

    Hello,
    How to find SQL server backup was taken under compression mode ? I have disabled the Compress Mode backup setting but I want to make sure the backup is taken without compression.
    Is there a script for that?
    Thanks
    JK

    I have disabled the Compress Mode backup
    That is only a default setting, in backup command you can always overwrite it to a different value.
    Olaf Helper
    [ Blog] [ Xing] [ MVP]

  • How to find relationship between database tables

    Hi Mate,s.
    Iam new to SAPBW , PLZ tell me , How to find releationship between database table(Transperent tables).
    Regards.
    harry

    hi harry,
    from your previous postings, i guess you are asking relationship between tables in r/3, following links may help :
    http://www.sapgenie.com/abap/tables.htm
    http://www.sapgenie.com/abap/tables_sd.htm
    http://www.sapgenie.com/abap/tables_mm.htm
    http://www.sapgenie.com/abap/tables_fi.htm
    http://www.sapgenie.com/abap/tables_ps.htm

  • How to take SQL Server Database backup from DB side

    Dear All,
    Please suggest how to take SQL Server Database backup from DB side?
    System Info-
    Portal Server (EP7)
    MS SQL Server
    Microsoft Windows 2003 Server
    Suggest ASAP.
    Thanks & Regards,
    Sameer

    Hi,
          I am planning to take SAP DB backup I need the procedure how to take backup. With in the server.
          My Operating System is IBM AIX
                 Database is  Oracle 10g
                 SAP BI7.0 through this I need to take backup.
         Note:
                1)  First of all I gone to /oracle/<SID>/102_64/dbs/init<SID>.sap and I changed the settings backup_dev_type = disk
                 backup_root_dir = /home/db0/test/sateesh/DB0backup
                 stage_root_dir = /home/db0/test/sateesh/DB0backup
               2) Then I gone to BRTOOLS I changed to disk there I scheduled Online backup
               3) Then I came to SAP DB13 I want to take daily backup. But the backup is not going properly what to do any mistake I had done
                    Try to give the valuable solution to take Online backup

  • How to find SQL database configured users without studio management .

    Hello Guys,
    Please how do I find the configured users on my sql database without using SQL studio management. Is there a way to find figured users through registry? 
    Regards, MassonTech

    Hello,
    No, you can't get it from registry.
    You must be connected to the SQL Server/database to query this information from the database; you can't get it from anywhere else.
    If you don't have SSMS installed on the machine, then you could use the lightweight tool "SqlCmd.exe", there is a separate installer for it available.
    Olaf Helper
    [ Blog] [ Xing] [ MVP]

  • How to find the statement by statementid

    I get the statementid from dba_audit_object. From there how can I find the sql statement associated with the statementid? Is there a DBA view for this?

    I think that means you are auditing an object, so that is not statement auditing, so there is no statement id.
    Also see http://asktom.oracle.com/pls/apex/f?p=100:11:0::::P11_QUESTION_ID:745878232038
    Edit: and [url http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/auditing.htm#DBSEG90022]extended mode
    Edited by: jgarry on Oct 24, 2011 2:02 PM

  • How to find sql query history

    hi friends ,
    am using orcl 10g in my oracle enterprise server, we use this interface to connect the database Sql Developer Ver 1.1.3,
    how to find the sql history, now i need to check 3 to 4 months back what are the update statement that has been queried and how to check the logs,
    though i have checked lots of views such as v$sqlarea ... etc i couldnot find any queries, and why i couldnot open redo logs.
    plz tell me is there any option to restrict update command in the future,
    also help me how to find the history , or what i should do further ,
    Waiting for ur results

    Use this query to get last 3 month queries order by execution.
    Query:
    select * from (select module,sql_id,round(sum(CPU_TIME_DELTA)/1000000) "CPUTIME(S)",round(sum(ELAPSED_TIME_DELTA)/1000000) "E
    LPSED(S)",round(sum(EXECUTIONS_DELTA)) "NUMOFEXEC",round(round(sum(ELAPSED_TIME_DELTA))/1000000)/(round(sum(EXECUTIONS_DELTA))) "Per Execution",sum(ROWS_PROCESSED_DELTA) "NUMOFROW",sum(DISK_READS_DELTA)/1024/1024 "DISK
    READ(MB)",sum(BUFFER_GETS_DELTA)/1024/1024 "BUFFERREAD(MB)" from dba_hist_sqlstat where (snap_id between (select min(snap_id)
    from dba_hist_snapshot where trunc(begin_interval_time)=trunc(sysdate-92 )) and (select max(snap_id) from dba_hist_snapshot
    where trunc(begin_interval_time)=trunc(sysdate ))) and EXECUTIONS_DELTA>10 group by module,sql_id order by "NUMOFEXEC" desc
    ) where rownum < 51;

  • How to execute sql statement under bat file?

    I want to execute following statement
    C:\>sqlplus /nolog
    SQL> conn scott/tiger
    SQL> select * from tab;
    I know I can realize it as following test.bat and testdb.sql file
    test.bat is follows:
    sqlplus /nolog @testdb.sql
    testdb.sql is follows:
    conn scott/tiger
    select * from tab;
    Now I don't want to use sql file,I only want to use bat file,like follows:
    test.bat is follows:
    sqlplus /nolog
    conn scott/tiger
    select * from tab;
    when I run test.bat,I find only sqlplus /nolog statement execute,the other statements don't execute.
    1)I want to know whether there is a method to execute sql statement only by bat file without a sql file? How to realize it?
    2)If I call sql file,how to hide passord of user? Because I don't want to other persons know scott password,if I use conn scott/tiger in testdb.sql,other person can see testdb.sql and know the password. Is there a good method to avoid?
    Thanks!

    I'm running *NIX, but works the same on Windows
    bcm@bcm-laptop:~$ cat here.sh
    sqlplus dbadmin/admindb << EOF
    select count(*) from user_objects;
    exit
    EOF
    bcm@bcm-laptop:~$ sh here.sh
    SQL*Plus: Release 11.2.0.1.0 Production on Mon May 17 18:14:09 2010
    Copyright (c) 1982, 2009, Oracle.  All rights reserved.
    Connected to:
    Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
    With the Partitioning, OLAP, Data Mining and Real Application Testing options
    SQL>
      COUNT(*)
          9
    SQL> Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
    With the Partitioning, OLAP, Data Mining and Real Application Testing options
    bcm@bcm-laptop:~$ Edited by: sb92075 on May 17, 2010 6:15 PM

  • DBAN reports 250 tablescans within 60sec - how to find the statements/field

    Hello,
    I try to fix performance/cache-hit-rate problems on a MaxDB v 7.5.00.44.
    I've fixed and improved several effects but there is still a pure Data-Cache-Hitrate
    > Cache Sizes
    >
    >
    >  I/O Buffer Cache:          1.562,50 MB
    >
    >     Data Cache:             1.549,00 MB
    >     Converter:                 12,88 MB
    >     Misc.:                      0,62 MB
    >
    >  Catalog Cache:           411.648,00 MB
    >
    >  Sequence Cache:                0,01 MB
    >
    > Cache Accesses
    >
    >                                Acesses          Successful    Unsuccessful       Hit Rate
    >
    >  Data Cache:             8.143.185.274      7.915.878.680       227.306.594       97,21 %
    >  SQL Data:               8.140.734.533      7.913.427.939       227.306.594       97,21 %
    >
    >  History/Undo:               2.450.874          2.450.874                 0      100,00 %
    >
    >  Catalog Cache:          3.334.089.052      3.150.536.080       183.554.889       94,49 %
    >  Sequence Cache:                 1.063              1.062                 1       99,91 %
    >
    > Parameters
    >
    >  CACHE_SIZE:                  200000
    >
    >  CAT_CACHE_SUPPLY:            52690944
    >
    >  USE_MEM_ENHANCE:
    >
    >  MEM_ENHANCE_LIMIT:
    The DB-analyzer with interval 60 sec reports to me that there are more than 200 table-scans within a minute
    > ===== #2          at 2008-03-26 14:46:17
    > *  I  SQL commands executed: 10859, avg. 182.11 per second
    >       CON: PureSQL_Cmds > INTERVAL * 5
    >       VAL: 10859        > 61       * 5
    > * W3  Data cache hitrate (SQL Pages) 80.69%, 448569 of 2322671 accesses failed
    >       CON: DC_Hit < 96 && ( PReads ) > MAX_IDLE_IO_ALL_DEVS
    >       VAL: 80.69  < 96 && ( 448570 ) > 2440                
    >       ACT: In addition to enlarging the data cache (note the paging risk of the operating system), search for the cause of the high read activity. Frequently, individual SQL statements cause a high percentage of the total logical and physical read activities. Enlarging the cache only moves the load from the disk to the CPU although an additional index could transform a read-intensive table scan into a cheap direct access.
    >       DES: For a running database application the data cache hitrate should not be less than 99%, otherwise too much data has to be read physically. Data cache hitrates less than 99% for intervals of 15 minutes or more must be avoided.
    > * W3  Selects and fetches selectivity 0.02%: 2779 selects and fetches, 20199200 rows read, 4033 rows qualified
    >       CON: SelFetSel < 0.3
    >       VAL: 0.02      < 0.3
    > * W1  Updates selectivity 3.66%: 316 updates, 4129 rows read, 151 rows qualified
    >       CON: UpdSel < 5.0
    >       VAL: 3.66   < 5.0
    > * W3  215 table scans, selectivity 0.00%: 21087692 rows read, 323 rows qualified
    >       CON: TabScanSel < 0.3
    >       VAL: 0.00       < 0.3
    > *  I  Number of physical reads: 448570
    >       CON: PReads > ( 4 * MAX_IDLE_IO_ALL_DEVS )
    >       VAL: 448570 > ( 4 * 2440                 )
    My DBA-user holds 273 tables (some with millions of rows) with 563 indizies on it - my feeling is at last one index is still missing...
    Our own CRM-system offers the possibility to "click together" requests - what makes it nearly impossible to get reasonable informations concerning the WHERE clauses.
    The high amount of tablescans let me think that it must be in a often used function - but i can't figure out which ...
    Now I have two questions
    1.) Is there any "best-practice" to find out (on server-side) which statement (WHERE-part?)
        caused the tablescans ( a trace had no stisfying result to me - maybe you can give
        me a hint with the right option and debug-level)
    2.) More common question to shared memory resources:
        Referring to the parameter "CACHE_IN_SHARED_MEMORY"  ( "...can lead to performance problems on NUMA architectures.")
        Which CACHE is ment by this parameter - set this to YES and tell OS to share three of four gigs of memory?
        Is there any documentation/commendation what is best memory-setup on SMP-Linux?
    Any hints are welcome - thanks in advance
    Harald Flaucher

    Hi,
    there is no complex command to start all the command monitor options together. It's correct you must start each option with the seperate command.
    This gives the possibility to switch only some of the monitoring options on, if you are searching e.g. those commands which have bad selectivity or high read og data.
    Ok - without SMP LOGIN you cannot check the FAQ notes.
    About the kernel parameters you will find information when you check the parameters via DBMGUI. This is only a short description about parameters.
    You can check the MaxDb documenation if you can find more information about the parameter you are interrested in there:
    [param-doku|http://maxdb.sap.com/doc/7_7/44/bd1ec6a5d51388e10000000a155369/frameset.htm]
    And you can check the cserv.pcf file to get the dependencies of the serveral parameters to each other.
    Check the workshop material as well if you can find more information about the parameters there: [maxdb.sap.com|http://maxdb.sap.com]
    Hope this will help.
    Regards, Christiane

Maybe you are looking for