Purging of Audit Records(FGA)

Hi,
I have enabled Fine Grain Auditing on production database with an DBMS_FGA.XML,DBMS_FGA.EXTENTED options.Files are getting generated in the ADUMP destination with XML format.I have purged all the XML audit files that are generated on 24-NOV-2010 from ADUMP destination.Even though when i have purged the files when i have queried the following query for the date 24-nov-2010 my query is still giving the results for the date 24-nov.
select sql_text ,object_name,db_user from v$xml_audit_trail where trunc(EXTENDED_TIMESTAMP)='24-NOV-2010'
According to my knowledge for the fine grain audting with the XML option when i have queried the V$XML_AUDIT_TRAIL dynamic view oracle will parse the XML files which are in adump dest and share the results.
Could you please assist me even though records for the date 24-nov not exists in adump destination how ORACLE is showing the contents in V$XML_AUDIT_TRAIL
Thanks in advance..
Regards,

which database version
Edited by: shaiffy on 25-Nov-2010 10:46 AM

Similar Messages

Purging Audit records

Hopefully someone can answer this for me. I'm running AV 10.3 on Solaris 10. Both of my source databases are on OEL 5 and are 11.2.0.2. I am currently writing the audit trail to the DB.
Will the collector (or some other piece) update the LAST_ARCHIVE_TS attribute on the source database?
I want to set up the purge job to only purge archived audit logs, but this attribute is not set on my source databases. From reading the documents it looks like something on the AV side should be calling DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP, but I don't see that happening.
Thanks for the help.
Edited by: jdfjsu99 on May 21, 2012 1:51 PM

I will give another solution for purging your audit log.I think it simple we can schedule with help of DBscheduler .Please look it below.
Timestamp Creating Schedule(Everyday it will create a time stamp for purging job)
/* Timestamp creation for FGA Auditing */
BEGIN
DBMS_SCHEDULER.CREATE_JOB (
job_name => 'DAILY_AUDIT_ARC_FGA_TIMESTAMP',
job_type => 'PLSQL_BLOCK',
job_action => 'BEGIN DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(AUDIT_TRAIL_TYPE =>
DBMS_AUDIT_MGMT.AUDIT_TRAIL_FGA_STD,LAST_ARCHIVE_TIME => sysdate-7); END;',
start_date => sysdate,
repeat_interval => 'FREQ=HOURLY;INTERVAL=24',
enabled => TRUE,
comments => 'Create an archive timestamp'
END;
/* Timestamp creation for standard Auditing */
BEGIN
DBMS_SCHEDULER.CREATE_JOB (
job_name => 'DAILY_AUDIT_ARC_COMN_TIMESTAMP',
job_type => 'PLSQL_BLOCK',
job_action => 'BEGIN DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(AUDIT_TRAIL_TYPE =>
DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,LAST_ARCHIVE_TIME => sysdate-7); END;',
start_date => sysdate,
repeat_interval => 'FREQ=HOURLY;INTERVAL=12',
enabled => TRUE,
comments => 'Create an archive timestamp'
END;
/* Cleanup Initialization for FGA */
BEGIN
     DBMS_AUDIT_MGMT.INIT_CLEANUP(
     AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_FGA_STD,
     DEFAULT_CLEANUP_INTERVAL => 24);-- DEFAULT TIME INTERVAL
END;
/* Cleanup Initialization for standard audit */
BEGIN
     DBMS_AUDIT_MGMT.INIT_CLEANUP(
     AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
     DEFAULT_CLEANUP_INTERVAL => 24);-- DEFAULT TIME INTERVAL
END;
/* Purge job Creation for FGA audit*/
BEGIN
DBMS_AUDIT_MGMT.CREATE_PURGE_JOB(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_FGA_STD,
AUDIT_TRAIL_PURGE_INTERVAL => 24/* hours */,
AUDIT_TRAIL_PURGE_NAME => 'Daily_FGA_Audit_Purge_Job',
USE_LAST_ARCH_TIMESTAMP => TRUE
END;
/* Purge job Creation for standard audit*/
BEGIN
DBMS_AUDIT_MGMT.CREATE_PURGE_JOB(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
AUDIT_TRAIL_PURGE_INTERVAL => 24/* hours */,
AUDIT_TRAIL_PURGE_NAME => 'Daily_COMN_Audit_Purge_Job',
USE_LAST_ARCH_TIMESTAMP => TRUE
END;
commit;

Fine Grained Audit records to syslog

Hello experts,
I am working on Standard Auditing and Fine Grained Auditing on 11.2.0.3 databases on Red Hat x86_64.
I am trying to send Fine Grained Audit records to syslog as for my Standard Audit records with audit_trail set to OS, but can't find any appropriate option.
When I create FGA policies with the ADD_POLICY procedure of the DBMS_FGA package, the audit_trail parameter can only be set to DB or XML, as stated in [PL/SQL Packages and Types Reference|http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_fga.htm#CDEIECAG].
Does somebody know if it is possible to send FGA audit records to syslog directly:
1. without using any additional product (e.g. Oracle Audit Vault)?
2. without doing manual extraction from fga_log$ or DBA_COMMON_AUDIT_TRAIL?
Thanks for any suggestion.

Hi,
Well, i did not used FGA yet.
I used audit_Trail=db and the query SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail WHERE to_char(extended_timestamp, 'DD/MM/RR') = to_char(SYSDATE - 1, 'DD/MM/RR') ORDER BY timestamp)
Then i wrote a procedure, and exported the results using utl_file .
And i scheduled this procedure to run daily.
It works pretty good, if you like the solution as ask for details.
Hope that helps,
Regards.

Is it safe to purge / delete older records from AUD$ table in SYS schema

Hi,
Can we purge / delete older records from AUD$ table in SYS schema.
Please advice.
Thanks
Naveen

Pl see MOS Doc 73408.1 (How to Truncate, Delete, or Purge Rows from the Audit Trail Table SYS.AUD$) fro details on how to do so.
HTH
Srini

While Installation of 11g database creation time error ORA-28056: Writing audit records to Windows Event Log failed Error

Hi Friends,
OS = Windows XP 3
Database = Oracle 11g R2 32 bit
Processor= intel p4 2.86 Ghz
Ram = 2 gb
Virtual memory = 4gb
I was able to install the oracle 11g successfully, but during installation at the time of database creation I got the following error many times and I ignored it many times... but at 55% finally My installation was hanged nothing was happening after it.....
ORA-28056: Writing audit records to Windows Event Log failed Error and at 55% my Installation got hung,,,, I end the installation and tried to create the database afterward by DBCA but same thing happened....
Please some one help me out, as i need to install on the same machine .....
Thanks and Regards

AAP wrote:
Thanks Now I am able to Create a database , but with one error,
When I created a database using DBCA, at the last stage I got this error,
Database Configuration Assistant : Warning
Enterprise Manager Configuration Failed due to the Following error Listener is not up or database service is not registered with it. Start the listener & Registered database service & run EM Configuration Assistant again....
But when I checked the listener was up.....
Now what was the problem, I am able to connect and work through sqlplus,
But I didnt got the link of EM and when try to create a new connection in sql developer it is giving error ( Status : failure - Test Failed the Network Adapter could not establish the connection )
Thanks & Regards
Creation of the dbcontrol requires a connection via the listener. When configuring the dbcontrol as part of database creation, it appears that the dbcontrol creation step runs before the dynamic registration of the databsase with the listener is complete. Now that the database itself is completed and enough time (really, just a minute or two) has passed to allow the instance to register, use dbca or emca to create the dbcontrol.
Are you able to get a sqlplus connection via the listener (sqlplus scott/tiger@orcl)? That needs to be the first order of business.

CRM 2011: when auditing is turned off, why do existing Audit records lose "New Value"?

Not sure if this is by design (if so, would love to know why!) or if this is a bug. Let's say I have auditing turned on for Accounts. I change the phone number in the Main Phone field from 555-1111 to 555-5555, and an audit record is
created showing the Old Value (555-1111) and New Value (555-5555). Great. Now I turn off auditing. The system goes back to the audit record that had previously been created, and modifies it so that it shows the Old Value (555-1111),
and inserts an icon into the New Value field indicating auditing was turned off. The tool tip for that icon states "Auditing was stopped and restarted. The new values for the fields that changed during this period cannot be identified or recorded."
First of all (minor picky issue) auditing hasn't been turned back on yet, despite what the tool tip says (says the same thing whether or not auditing is turned back on). But the real problem is
why the existing audit record's New Value would be removed... why would that happen?!? We're talking about a historical update. It really did change, and the system knew what it changed from/to, so why would the system remove that new value
from the audit record? Logically I would expect that any changes made
while auditing is off would not be logged, and that once auditing is turned back on, Old/New values would correspond to whatever was/is in the system at the time that any new audit record is created, so there may be a disconnect between an older audit
record and a new one (old record's New Value not matching the new record's Old Value, because changes were made while auditing was off). And it's quite apparent when auditing is turned off, because an audit record is created stating "Auditing Disabled".
Any ideas if there's a logical reason why it would do this, or if this is really a bug that Microsoft needs to fix? We have a client with a business need to periodically turn off auditing while integration updates run between CRM and another system
(otherwise hundreds of thousands of unnecessary audit records would be created). But if they're going to lose audit data every time they disable auditing, the auditing is worthless.

We wouldn't ever temporarily turn auditing off on purpose... it's happening when we import managed solutions. We have vendors with managed solutions that contain system entities such as Contacts. When importing their solution, it momentarily
turns auditing off on those entities. The only evidence of this is audit records indicating "Entity Audit Stopped", and of course the loss of all the most recent "new value" on all audit records. The interesting (?) parts of this are:
1. When importing the managed solution, the recommended option to keep all existing customizations is selected. I would think this would include the audit settings on the entity, but apparently not (sort of... see #2).
2. As soon as the managed solution is imported, in addition to creating an "Entity Audit Stopped" audit record on relevant entities and wiping out new values, it apparently turns auditing back on, yet there's no record of this (in customizations, the entity
still (or once again) indicates auditing is enabled; but on records for that entity, there is no "Entity Audit Enabled" record.
So, now it's on to working with the vendors, to dig into their managed solutions and see if there's a way to prevent this!

Oracle 11g R2 write audit record to application event log in Windows server

Hi,
I have a oracle 11g R1 database in windows 2003 server,
I set the init parameter audit_trail=db,extended,
but some auditing record still keep writting to windows application log
Event Type:     Information
Event Source:     Oracle.test
Event Category:     None
Event ID:     34
Date:          9/7/2011
Time:          3:36:38 PM
User:          N/A
Computer:     test
Description:
Audit trail: LENGTH: "226" SESSIONID:[7] "3875588" ENTRYID:[1] "1" USERID:[8] "test" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "1" LOGOFF$LREAD:[3] "755" LOGOFF$LWRITE:[2] "26" LOGOFF$DEAD:[1] "0" DBID:[10] "1613217480" SESSIONCPU:[1] "0".
Is there any way to disable this?
Thanks
Vincent

oh really, dont you say?
maybe next time read the whole note, not just the title
"In 11g these 'logoff by cleanup' audit records are not logged in DBA_AUDIT_TRAIL. The connection record remains as 'logon' record. It is not updated to 'logoff by cleanup'. *In these cases, the log off information like logoff_time, logoff_lread etc are written to an OS audit file as 'logoff by cleanup' audit record.* "

Error: Unable to insert new audit record for auditee 21 in repository UPA..

Hi,
I've got the error message below. Have you ever got this?
DEBUG [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.DATABASE - insert into UPA (UPA_KEY,usr_key,EFF_FROM_DATE,SRC,SNAPSHOT,DELTAS) values (?,?,?,?,?,?)
DEBUG [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.DATABASE - select UPA_seq.nextval from dual
ERROR [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.DATABASE - Class/Method: tcDataBase/writeStatement encounter some problems: ORA-01461: can bind a LONG value only for insert into a LONG column
java.sql.SQLException: ORA-01461: can bind a LONG value only for insert into a LONG column
     at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)
     at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:112)
     at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:173)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:413)
     at oracle.jdbc.driver.T4C8Oall.receive(T4C8Oall.java:1030)
     at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:194)
     at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:947)
     at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1222)
     at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3381)
     at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:3462)
     at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:1349)
     at weblogic.jdbc.wrapper.PreparedStatement.executeUpdate(PreparedStatement.java:159)
     at com.thortech.xl.dataaccess.tcDataBase.writePreparedStatement(Unknown Source)
     at com.thortech.xl.dataobj.PreparedStatementUtil.executeUpdate(Unknown Source)
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
ERROR [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.AUDITOR - Failed to process audit message
com.thortech.xl.audit.exceptions.AuditMsgProcessingFailedException: Unable to insert new audit record for auditee 21 in repository UPA
sert statement failed is: insert into UPA (UPA_KEY,usr_key,EFF_FROM_DATE,SRC,SNAPSHOT,DELTAS) values (?,?,?,?,?,?)
auditRepository=UPA_KEY; auditeeID=21
auditEpoch=2009-09-05 15:58:37.284; source=User: USER.TEST, API: com.thortech.xl.ejb.beansimpl.tcProvisioningOperationsBean, Method: updateTask
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by [Nested Exception]:
com.thortech.xl.orb.dataaccess.tcDataAccessException
     at com.thortech.xl.dataaccess.tcDataAccessExceptionUtil.createException(Unknown Source)
     at com.thortech.xl.dataaccess.tcDataBase.createException(Unknown Source)
     at com.thortech.xl.dataaccess.tcDataBase.writePreparedStatement(Unknown Source)
     at com.thortech.xl.dataobj.PreparedStatementUtil.executeUpdate(Unknown Source)
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by [Nested Exception]:
java.sql.SQLException: ORA-01461: can bind a LONG value only for insert into a LONG column
     at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)
     at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:112)
     at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:173)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:413)
     at oracle.jdbc.driver.T4C8Oall.receive(T4C8Oall.java:1030)
     at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:194)
     at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:947)
     at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1222)
     at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3381)
     at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:3462)
     at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:1349)
     at weblogic.jdbc.wrapper.PreparedStatement.executeUpdate(PreparedStatement.java:159)
     at com.thortech.xl.dataaccess.tcDataBase.writePreparedStatement(Unknown Source)
     at com.thortech.xl.dataobj.PreparedStatementUtil.executeUpdate(Unknown Source)
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)

Hello Peter:
Thanks! I tried to input two detail records and still get only one error.
I don't have pre/post trigger in my form. I use WHEN_BUTTON_PRESSED trigger with the following code:
if get_block_property('PARENT_DATA',status) = 'CHANGED' or
get_block_property('DETAIL_DATA',status) in ('CHANGED') then
COMMIT;
I also try File -> Save. It does not work either.
Do I need to pre/and post trigger to check for it? If so, please show me how.
Thanks again,
TD

What to audit and how to manage the audit records in oracle 11gr2

can anyone help me how to audit and manage the audit records in oracle 11gr2

867726 wrote:
can anyone help me how to audit and manage the audit records in oracle 11gr2
Hi,
I would recommend have a read this link for details http://download.oracle.com/docs/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#TDPSG50000
Cheers

How could I investigate SQL statement from standard audit record ?

We use Oracle 11gR2.
We use standard audit , audit_trail=DB.
We found suspicious audit record but that SQL_BIND,SQL_TEXT colums were NULL.
How could I investigate that SQL statement from standard audit record ?

Only "DB, EXTENDED" would cause the SQL statement to be captured.
If you have the Diagnostics Pack licence you could try querying DBA_HIST_SQLTEXT (joined to DBA_HIST_SNAPSHOT) -- but this would only list SQLs captured by AWR (i.e. the "Top 'N'" SQLs in that snapshot).
Hemant K Chitale

Multiple Audit Records created

We have seen that when executing certain workflows, IdM tends to log multiple audit records for the same task. This results in 2 identical records being created in the audit logs as seen in the Today's Report.
Can anyone help with understanding why this occurs and how to resolve this?

Frequently we see this behavior, and I'd love to know if there's a product issue that does this.
One reason we sometimes see duplicate entries is that IDM actually updates the account twice. E.g., if a workflow loads a user, checks the user in, then reloads the user and rechecks it in again later, we see two updates.
A common cause of double saves seems to be that IDM stores dates in memory in a different format than it does in the database, but IDM appears to compare the actual date values as strings. If you check out a view with a date in it, and then save it (without making any changes) the record is still treated as updated. E.g., "1 Jan 2009 10:00:00AM" in IDM memory vs. "01/01/2009 10:00:00" in the database.
But that only explains some of the duplicates we see.

Excessive audit record "Invalid token"

Excessive audit record "Invalid token" in audit database for one column occuring repeatedly can we know whats the reason behind this why it is caused and any way to resolve this ?

Hi Caroline,
Thanks for your reply.
Iam seeing directly in Audit database and for every 35 seconds and its being generated in column detail_text as "invalid token" simultaneously its showing in event_type_description as "user log on fails"
Please let me know what is the way to resolve it or what's reson behind this.
Regards,
Ram.

Unable to purge execution audit data using repo browser

Since upgrading to OWB 11.2.0.2 I am unable to purge execution audit details from my control centers using the Repository Browser. The select boxes are greyed out so I cannot select jobs and click "Purge Selected Audit Details". This worked fine in 10.2.0.5.
Purging deployment audit details this way works fine. Anyone know if this function in the repo browser is broken in 11.2.0.2?
PS: I am aware of the sql scripts that could be used but I prefer doing it using the repo browser.

the procedure of ADD-policy is down
PROCEDURE add_policy(object_schema IN VARCHAR2 := NULL,
object_name IN VARCHAR2,
policy_name IN VARCHAR2,
audit_condition IN VARCHAR2 := '1=1',
audit_column IN VARCHAR2 := NULL,
handler_schema IN VARCHAR2 := NULL,
handler_module IN VARCHAR2 := NULL,
enable IN BOOLEAN := TRUE);
you have written extra one paramater is"statement_types=> 'INSERT, UPDATE'".
here is the correct code, but u need to execute permission on DBMS_FGA packege from sys user. connect as sys user then give command
SQL> connect sys/1 as sysdba
Connected.
SQL> grant execute on DBMS_FGA to scott;
Grant succeeded.
SQL> connect scott/tiger
Connected.
SQL> begin
2 DBMS_FGA.ADD_POLICY(
3 object_schema => 'scott',
4 object_name=>'emp',
5 policy_name => 'mypolicy1',
6 audit_condition => 'sal < 100',
7 audit_column =>'comm, credit_card, expirn_date',
8 handler_schema => NULL,
9 handler_module => NULL,
10 enable => TRUE);
11 end;
12 /
PL/SQL procedure successfully completed.
Message was edited by:
Md Ruhul Amin

How to clean Audit records from OIM

Hi All,
I need to clean Audit records in OIM that are older than 15 months and I found out the following tables contains information about audits
1.UPA
2.UPA_FIELDS
3.UPA_GRP_MEMBERSHIP
4.UPA_RESOURCE
5.UPA_UD_FORMFIELDS
6.UPA_UD_FORMS
7.UPA_USR
How to develop script to delete the records older than 15 months?
Except UPA table, all other tables contain the column name "CREATE_DATE" & "UPDATE_DATE". what is the difference? and which one is required to implement above scenario?
Please guide me on the same...
Thanks in advance

Whenever you enable auditing the information about User Account Changes is captured in form of Snapshots and stored in the UPA table which would eventually flow to the remaining tales after being separated by normalizing this data using a post-processor internal to OIM auditing engine.
- So for remaining tables this is used moreover for reporting purposes in OIM. If you clear the data then the you know what you are doing ?
- Now for the primary table UPA you need to look for fields EFF_FROM_DATE & EFF_TO_DATE

Moving audit Records from one database to another database using dblink

i got five database, i have to move sys.aud$ records from five databases to one centralized database into another schema every day at 10:00 clock, i have to use a dblink for this, i have to create same table as sys.aud$ with different schema in centralized database with one extra column db_unique_name,by using db_link how i need to move records from all the five databases to one centralized database, can anyone help me here how to create a db_link from to move records from five database to one centralized database, due to maintainance perspective i have to move the records from all the five databases to one centralized database. i have to write a script for moving the audit records from all the five databases to one centralized database, can anyone help me how to write the script, or if you have any related scripts , can u post here, it will helpful for me.

spool audit.log
--"Auditing Initialisation Parameters: check initialization parameter"
select name || '=' || value from v$parameter where name like '%audit%'
---"if auditing is disabled then issue this command and bounce"
alter system set audit_trail=db,extended scope = spfile
shutdown immediate
startup
create tablespace ORDER_DATA datafile '+DDATA' size 50m;
create user INFO identified by INFO;
Grant connect,resource to INFO;
Alter user INFO quota unlimited on ORDER_DATA;
create table INFO.ORDER as select * from sys.aud$;
alter INFO.ORDER add db_unique_name varchar2(50);
create table INFO.ORDER
partition by range (Timestamp#)
subpartition by hash(dbid)
subpartition template
(subpartition sp1 tablespace users,
subpartition sp2 tablespace users)(
partition p1 values less than (TO_DATE('07/29/2010','MM/DD/YYYY')),
partition p2 values less than (TO_DATE('07/29/2011','MM/DD/YYYY')),
partition p3 values less than (MAXVALUE)) tablespace BGORDER_DATA as select * from sys.aud$
spool off;
exit
BEGIN
DBMS_SCHEDULER.create_job(
job_name => 'Move Aud$ records',
job_type => 'PLSQL_BLOCK',
job_action => 'CREATE OR REPLACE PROCEDURE bgorder_aud
                    AS
               ts TIMESTAMP;
               BEGIN
ts := SYSTIMESTAMP;
insert into info.order select * from sys.aud$ where timestamp# < ts;
delete sys.aud$ where timestamp# < ts;
commit;
END;
start_date => TRUNC(SYSDATE) + 22 / 24,
repeat_interval => 'FREQ=daily;BYHOUR=22;BYMINUTE=0;BYSECOND=0',
enabled => TRUE,
comments => 'Move records');
END;
/

Purging of Audit Records(FGA)

Similar Messages

Maybe you are looking for