Oblix v7 audit log file missing

Hi,
I'm using oblix v7.
I have enabled audit logs and specified the file name as: C:\audit33.txt
But on the machine there is no such file. It is somehow missing.
The same configuration works on another machine.
Any idea why the audit log file is missing?
Thanks.
Sash.

I response myself.
There is no way to set the Date/Time format to any other than UTC for the OAM component logs
See note 742777.1 for deeph information.
Julio.

Similar Messages

Bad date recorded by AccessServer in Audit Log File

Hi all,
I have installed OAM and configure Audit Log File to AccessServer:
Access System Configuration >> Access Server Configuration >> and put ON "Audit to File"
The log is recorded OK, but when compare the date writed in log file with SO date, there are 6hs of diference
LOG FILE
01\/28\/2009 *00:18:07* \-0500 - AUTHZ_SUCCESS - GET - AccessServer - 192.168.3.105 - sec.biosnettcs.com\/access\/oblix\/lang\/en\-us\/msgctlg.js - cn=orcladmin\,cn=Users\,dc=biosnettcs\,dc=com - 00:18:07 - http - AccessGate - - 2
SO date
# date
mar ene 27 *18:18:15 CST* 2009
# date -u
miÃ© ene 28 *00:18:23 UTC* 2009
How we can see in this lines the audit log is recording date in UTC, but a need this in the timezone setted in SO.
How can do this (print date in audit log file with the same timezone setted by SO)??
Thaks in advance,
Julio

I response myself.
There is no way to set the Date/Time format to any other than UTC for the OAM component logs
See note 742777.1 for deeph information.
Julio.

BOE XI 3.1 Removing Audit log files

Hi there experts,
we have an issue with our production BOE install (3.1 SP7) whereby we have over 39,000 audit log files awaiting processing in the BOE_HOME/auditing folder. These audit files were generated a few months back when we had an issue with the system whereby thousands of scheduled events were created, we are not sure how. The removal of these events has had a knock on effect in that we have too many audit files to process, ie the system just cant process them all quickly enough.
So my question is can we just remove these audit files from the auditing directory with no knock on effects as we dont need them loading into the audit database anyways as they are all multiples of the same event.
As an aside when we upgraded from SP3 to SP7 the problem went away, ie no new audit files for these delete events being generated. We are still to establish how/why these audit events were created but for the time being we just want to be able to remove them. Unfortunately as its a production system we don't want to just take a chance and remove them without some advice first.
thanks in advance
Scott

Is your auditing running now? Or still pending? Can you check in Audit DB, what is the max(audit_timestamp? This will tell you when was the recent actvitiy happened.
Deleting the audit files, will not harm to your BO system. You will not be able to see auditing details for that period.
Is the new auditing files are processed? or you still see the files created in auditing folder without processing?
If the auditing file size shows 0 okb, than it means they were processed.

Maximum number of events per audit log file must be greater than 0.

BOE-XI (R2)
Windows Server 2003
Running AUDIT features on all services.
Report Application Server (RAS) keeps giving the following error in the Windows Application Event Log.
Maximum number of events per audit log file must be greater than 0. Defaulting to 500.
I am assuming that this is because the RAS is not being used by anyone at this time - and there is nothing in the local-audit-log to be copied to the AUDIT database.
Is there any way to suppress this error...?
Thanks in advance for the advice!

A couple more reboots after applying service pack 3 seemed to fix the issue.
Also had to go to IIS and set the BusinessObjects and CrystalEnterprise11 web sites to use ASP .NET 1.1 instead of 2.

Any software/program that can read audit log files

Hi,
Currently i am searching for a program/tools that can read audit log files and format it into a readable format. Anyone know is there any in the market or any open source program?
Thank You.

Not sure what you mean by "audit log".
Anyway. Pete Finnigan's tools page has only one thing that might be what you're looking for - LMON, which runs on BSD, Solaris, Linux. As he's the go-to guy for Oracle security the chances of there being a good free log analyzer tool that he hasn't heard of is slight.
Cheers, APC

The format of Audit log file

We have a perl script to extract data from Audit log files(Oracle Database 10g Release 10.2.0.1.0) which have format as bellow.
Audit file /u03/oracle/admin/NIKKOU/adump/ora_5037.aud
Oracle Database 10g Release 10.2.0.1.0 - Production
ORACLE_HOME = /u01/app/oracle/product/10.2.0
System name:     Linux
Node name:     TOYDBSV01
Release:     2.6.9-34.ELsmp
Version:     #1 SMP Fri Feb 24 16:54:53 EST 2006
Machine:     i686
Instance name: NIKKOU
Redo thread mounted by this instance: 1
Oracle process number: 22
Unix process pid: 5037, image: oracleNIKKOU@TOYDBSV01
Sun Jul 27 03:06:34 2008
ACTION : 'CONNECT'
DATABASE USER: 'sys'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL:
STATUS: 0
After we update the db from Release 10.2.0.1.0 to Release 10.2.0.4.0, the format of Audit log file had been changed to something likes below.
Audit file /u03/oracle/admin/NIKKOU/adump/ora_1897.aud
Oracle Database 10g Release 10.2.0.4.0 - Production
ORACLE_HOME = /u01/app/oracle/product/10.2.0
System name:     Linux
Node name:     TOYDBSV01
Release:     2.6.9-34.ELsmp
Version:     #1 SMP Fri Feb 24 16:54:53 EST 2006
Machine:     i686
Instance name: NIKKOU
Redo thread mounted by this instance: 1
Oracle process number: 21
Unix process pid: 1897, image: oracle@TOYDBSV01
Tue Oct 14 10:30:29 2008
LENGTH : '135'
ACTION :[7] 'CONNECT'
DATABASE USER:[3] 'SYS'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[0] ''
CLIENT TERMINAL:[7] 'unknown'
STATUS:[1] '0'
Because we have to rewrite the perl script, could anyone tell us where we can find the manual to describe the format of the Audit log file.

Oracle publishes views of the audit trail data. You can find a list of the views for the 11.1 database here:
http://download.oracle.com/docs/cd/B28359_01/network.111/b28531/auditing.htm#BCGIICFE
The audit trail does not really change between patchsets as that would constitute underlying structure changes and right now, the developers are not allowed to change the underlying structure of tables in patchsets. But, we can change what may be displayed in a column from patchset to patchset. For example, we are getting ready to update the comment$text field to display more information like dblinks and program names.
I personally don't like overloading the comment$text field like that, but sometimes when you need the information, that is the only choice except to wait for the next major release :)
As for the output of the audit log files, those can change between patchsets because of bugs that were found and some changes to support Audit Vault. My apologies out there for anyone that is reading the audit files written to the OS directly, I would recommend using the views.
Hope that helps. Tammy

Log-File missing

Hello,
I´ve done a stupid mistake, I hope anybody can help me now:
I have reorganized the hard disks of my pc and unfortunally formatted a seemingly unessential disk.
Now, my Basis-System (MaxDB 7.6.00.35) is crashing when starting the database:
VOLUMEIO Could not open volume 'F:sapdbP00saplogDISKL001', rc = 2
IOMan Attach error on log volume 1: could not open volume
Stupidly I have never done a backup of this file, because I thought, the log file residents on another disk.
The database is using "Override mode for log area ON".
I would be very grateful if anybody ca give my a hint what to do now.
Kind regards
Volker

>
VOLUMEIO Could not open volume 'F:\sapdb\P00\saplog\DISKL001', rc = 2
> IOMan Attach error on log volume 1: could not open volume
>
> Stupidly I have never done a backup of this file, because I thought, the log file residents on another disk.
> The database is using "Override mode for log area ON".
Hi Volker,
Usually you don't make backups of this file as you usually never backup any files of MaxDB.
What you may do right now is this:
1. Perform a full data backup of the Database in ADMIN MODE. You can do this easily with the DBMGUI.
2. Once you have the full data backup, you need to perform a "Recovery with Initialization". This will recreate missing Log-Files.
3. After you've sucessfully recovered the database, I highly recommend to install the current patch (7.6.05) as the version you use is very old.
Best regards,
Lars

Remote management audit log file

I've read the documentation @
http://www.novell.com/documentation/...a/ad4zt4x.html
which indicates that the audit file is auditlog.txt and is located in the
system directory of the managed workstation. The problem is I can't find the
log file in that location or anywhere else on the computer. I even looked in
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent but I can't find
anything. Any ideas? Can someone point me in the right direction.
BTW, I'm using ZDM 6.5 SP2 for both the server and the workstations.
Jim Webb

Just an FYI, with ZDM 6.5 HP3 the file name changed from AuditLog.txt to
ZRMAudit.txt still located under system32 on Windows XP.
Jim Webb
>>> On 5/22/2006 at 3:27 PM, in message
<[email protected]>,
Jim Webb<[email protected]> wrote:
> Well I found out the ZDM 6.5 HP2 fixes the problem of the log file not
> being
> created.
>
> Jim Webb
>
>>>> On 5/19/2006 at 8:37 AM, in message
> <[email protected]>,
> Jim Webb<[email protected]> wrote:
>> Well, it does show up in the event log but not in the inventory. If I
>> disable inventory the log file won't be deleted, correct?
>>
>> Jim Webb
>>
>>>>> On 5/18/2006 at 10:03 AM, in message
>> <[email protected]>, Marcus
>> Breiden<[email protected]> wrote:
>>> Jim Webb wrote:
>>>
>>>> I did a search on a machine I am remote controlling, no log file. What
>>>> next?
>>> good question... does the session show up in the eventlog?

Growing nsure audit log file in sys\etc\logcache

I have a Netware 6.5 OES2 server that suddenly had a quickly growing file in the \sys\etc\logcache folder. The file has just recently stabilized, but I would like to shrink the file. I am aware that this is part of NSure auditing and would like to leave that running. Can the files in this directory be deleted, or how to I go about shrinking or truncating them?
Thanks.

That would be OES, as OES2 only exists on Linux.
TID 10089097 seems to cover this in a general sense:
configuring the PA on NetWare, is to configure the eDirectory, Filesystem, and Netware OS instrumentation. This is done at the NCP server object in iManager. From the eDirectory Administration task list, select Modify Object. Browse for server object. This is the NCP server object, in the tree, not the Secure Logging Server object in the Logging Services container. Click on the Nsure Audit tab. Below the tab, there will links to the individual components, eDirectory, NetWare, and Filesystem.
Without having it installed myself, I would expect that you could reset log files and suchlike in there.

Query log file missing

I am trying create a query log file for an ASO cube. I have created the database.cfg file in the database directory and restarted the application. Then I run a few queries, and stop the application. Query log file (database.qlg) is not created. My database.cfg file looks like this: QUERYLOG [LOB] QUERYLOG LOGFILESIZE 2 QUERYLOG TOTALLOGFILESIZE 1024 QUERYLOG ON Thanks

I am trying create a query log file for an ASO cube. I have created the database.cfg file in the database directory and restarted the application. Then I run a few queries, and stop the application. Query log file (database.qlg) is not created. My database.cfg file looks like this: QUERYLOG [LOB] QUERYLOG LOGFILESIZE 2 QUERYLOG TOTALLOGFILESIZE 1024 QUERYLOG ON Thanks

Nokia e5 licensersrv.log file missing

i have deleted licensersrv.log file many times to retain the lost space in phone memory but after a few delet i can not find this file any more my phone memory is still geting full but i can not find this file??
Thnaks alot in advance
Solved!
Go to Solution.

Try deleting cache files from browser, purge deleed emails from deleted mails inbox.
You can also go to Nokia Store and download NetQin Mobile Guard 3.0. It optimizes the OS deleting junk files, and so many other features. Very useful.
Regards.

MailSent.log File Missing

I am working on a client site that has MX7 installed and for
some reason they are having problems with email. So my first
thought, check out the mail.og and mailsent.log files in CFIDE. All
good for the mail.log file but there is no mailsent.log file in my
log files list. Err, where has it gone?
So I thought, maybe someone has deleted it. I would have
thought though that it would delete the contents not the file. And
if they did, how do I recreate it?
Thanks for your help.
Barb

I am working on a client site that has MX7 installed and for
some reason they are having problems with email. So my first
thought, check out the mail.og and mailsent.log files in CFIDE. All
good for the mail.log file but there is no mailsent.log file in my
log files list. Err, where has it gone?
So I thought, maybe someone has deleted it. I would have
thought though that it would delete the contents not the file. And
if they did, how do I recreate it?
Thanks for your help.
Barb

Audit log files user rights

Hello,
I started binary audit some of my servers. It works fine.
Generated files has 600 mask and root:root group:user. This makes my backup routines sick. Backup scripts work as another user and permission denied errors arises.
How can i change audit files mask?
Thanks,
Osman

Although I'm not sure I don't think you can since audit data will always need solid protection due to the included information. The only liable option I see is to use syslog as your logging daemon.

Log files missing interfaces transitions

For some reason I'm not seeing any log messages showing when interfaces trasitions from up to down or down to up. Primarily this is on the 4507R's we have but I have also noticed this on mnay of the other switches and routers even though I have logging set to informational.
Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I5K91S-M), Version 12.2(25)EWA5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 17-Nov-05 15:53 by alnguyen
Image text-base: 0x10000000, data-base: 0x115F1BE0
ROM: 12.1(20r)EW1
Dagobah Revision 95, Swamp Revision 3
Syslog logging: enabled (0 messages dropped, 658 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
    Console logging: level notifications, 13411 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 85 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level informational, 13458 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (8192 bytes)
    Count and timestamp logging messages: disabled
    Trap logging: level informational, 1419361 message lines logged
        Logging to ***.***.***.***, 645132 message lines logged, xml disabled,
               filtering disabled Syslog logging: enabled (0 messages dropped, 658 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

Hmmm, must be because your IOS is so backleveled. Did you try it on the interfaces ? It should work,
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sga/configuration/guide/sw_int.html#wp1065425

Recover from missing files(redo log file/control file) and state of the DB

Hello,
i hv go through the doc. as well. But have some doubts what will happen in each on these situations.
Pls help me to clarify these!
Scenario is like this;
hv 3 redo log files - multiplxed
hv 3 control files - multiplxed
- What will happen if 1 redo log file missing when starting the DB?
- What will happen if 1 redo log file missing when using(performing operations) the DB?
(will it recover automatically/db abort/even redo log lost will the DB run as usual... ?)
-How to recover this lost redo log?
- What will happen if 1 control file missing when starting the DB?
- What will happen if 1 control file missing when using(performing operations) the DB?
(will it recover automatically/db abort/even control file lost will the DB run as usual... ?)
-How to recover this lost redo log?
thanks

- What will happen if 1 redo log file missing when starting the DB?IF you have multiplexed the members you can drop the lost file and will be able to open the DB
What will happen if 1 redo log file missing when using(performing operations) the DB?Again if multiplexed it will drop a warinign in the alert log and contnue to write on othere members
http://download.oracle.com/docs/cd/B19306_01/backup.102/b14191/recoscen.htm#sthref1385
- What will happen if 1 control file missing when starting the DB?Just remove the entry from the init.ora and start the DB
What will happen if 1 control file missing when using(performing operations) the DB?Will shutdown

Oblix v7 audit log file missing

Similar Messages

Maybe you are looking for