Regarding accessing log file entries in Oracle 10g

Hi....
i need to watch all actions done by users of database to build intrusion detection system...
how can i get the log file entries and where it is stored in linux(oracle 10g)...is there any way to access logfile entries one by one..
thanx
in advance

Hi,
Probably you are looking for database auditing.
http://download.oracle.com/docs/cd/B19306_01/server.102/b14220/security.htm#sthref2916
Cheers,
Avinash

Similar Messages

Why can't read access log file in real-time? (Oracle Weblogic Server 10.3)

We can't read access log file in real-time. If access log is rotation to new file so can read access log file but can't read real-time.
*** Oracle Weblogic Server versions 10 R3

what's your meaning? try this command "tail -f access.log".
Threre is a buffer about 8K for WebLogic to write the access info into the log files, so you can't see the access info untill the buffer is full.

How has access.log file configured in WebLogic server 10.0?

1.) I am using BEA Weblogic 10.0 and my access.log is not getting updated.
2.) I also need any information as to how this Webblogic server forms chunks (ex....access00011.log,access00012.log) because i have a software called AWStats which merges all these chunks into 1 single access.log file under its subdirectory.
3.) I also need information as to how and where the user can specify/ form his own fields which gets displayed in the access.log
FYI i have 2 servers and i checked under Logging->HTTP->advanced, in both the servers options and configurations are same but in 1 it works fine and access.log is updating but not in the other one.
Kindly let me know i you have any leads into this issue!
Thanks,
Varun

Hi Ravish,
Firstly thanks for the reply.
1.) -----
What you can do is to set the buffer-size-kb parameter value to "0" in config.xml so that it can start logging once the server starts coming up rather then waiting for the default size which is 8kb to pass.
Something like below:
<web-server-log>
<buffer-size-kb>0</buffer-size-kb>
<web-server-log>
For more details check the below link:
Search for: CR302493
http://download.oracle.com/docs/cd/E11035_01/wls100/issues/known_resolved.html
--- for this issue i had browsed throught the forum before posting but in my conf file i have something like this instead of <buffer-size-kb>0</buffer-size-kb>
<web-server>
<web-server-log>
<number-of-files-limited>false</number-of-files-limited>
<log-file-format>extended</log-file-format>
</web-server-log>
</web-server>
So how do i go about the path of debugging now??
2.) -------
If you do not want rotation of access.log then you can just disable it from the below console path just by putting Rotation type as None
Server -> <YOUR_SERVER_NAME> -> Logging (tab) -> HTTP (sub-tab) -> Rotation type: None
---- for this in both my servers i have the settings like this,
Rotation type--> By Size
Rotation File size 5000
Begin rotation time 00:00
rotation interval 24
files to retain 7
and Log file rotation directory is left blank (to get created in same directory)
and also Rotate log file on startup is unchecked.
so??? what do you suggest!?
3.) ------
I also need information as to how and where the user can specify/ form his own fields which gets displayed in the access.log
---- regarding this, in my main server the access.log is getting updated and after 4.8Mb its creating 5Mb chunks. So, for example if the entire log is of 15 Mb then access.log stops updating at 4.98Mb and accesslog.out0001 and accesslog.out0002 is created with 5Mb each but the latest entry will be stored in accesslog.out0002 file. I hope i didn't complicate this :)
Regards,
Varun

How i can access log file in servlet?

How i can access log file in servlet then display it to browser.
          Can i have peice of codes...
          Thanks in advance.!


This is not something that can be answered easily. There is quite alot of code involved....
To get started I suggest you read up on the built-in package 'DBMS_LOB' from Oracle . Most of what you need you should find there.
regards Dave.

Retrive User & Cookie Information Using Apache Access Log Files

Hi All
The following information are not showing under Apache access log files that is used with Oracle Appserver (10g 10.1.2) given below.
1)User Informations
2)Cookie Informations
We are using below Commands in the httpd.conf File that have specified in the documents link given below
http://download-west.oracle.com/docs/cd/B31017_01/web.1013/q20201/logs.html#accesslog
LogFormat "%h %l %u %t \"%r\" %>s %b %v \"%{Referer}i\" \"%{User-Agent}i\" \"%{cookie}n\"" combined
Please anyone can tell what are the necessary informations that we have to specified in the httpd.conf file to retrive Cookie and user Informations.
Thanks to all
Sona

Thanks for your reply
Can u please check the below link for the cookie flag information
http://download-west.oracle.com/docs/cd/B31017_01/web.1013/q20201/mod/mod_usertrack.html
For your information i have logged in already.
Our Sample O/p is given below
151.146.191.186 - - [28/Dec/2006:10:13:05 +0530] "GET /Tab_files/lowerbox.gif HT
TP/1.1" 200 150 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows)"
We are using the below command format
LogFormat "%h %l %u %t \"%r\" %>s %b %{cookie}n \"%{Referer}i\" \"%{User-Agent}i\"" combined
But User and Cookie informations is not displaying.
what steps should i follow.
Looking for the favourable reply
Thanks

Retrive Cookie Information in the Apache Access Log Files

Hi All,
Can anyone give me the solution or any link to follow the steps for retriving cookie information and user information in the Apache Access log files using httpd.conf file.
we are using Oracle Appserver 10.1.2 Version and we have specfied below commands in httpd.conf file.
LogFormat "%h %l %u %t \"%r\" %>s %b %v \"%{Referer}i\" \"%{User-Agent}i\" \"%{cookie}n\"" combined
But it failed to retrive cookie and user informations
Looking forward any one help.....
Thanks
Regards
Sona

Thanks for your reply
Can u please check the below link for the cookie flag information
http://download-west.oracle.com/docs/cd/B31017_01/web.1013/q20201/mod/mod_usertrack.html
For your information i have logged in already.
Our Sample O/p is given below
151.146.191.186 - - [28/Dec/2006:10:13:05 +0530] "GET /Tab_files/lowerbox.gif HT
TP/1.1" 200 150 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows)"
We are using the below command format
LogFormat "%h %l %u %t \"%r\" %>s %b %{cookie}n \"%{Referer}i\" \"%{User-Agent}i\"" combined
But User and Cookie informations is not displaying.
what steps should i follow.
Looking for the favourable reply
Thanks

How to provide access to v$tables in oracle 10g to user

Hi,
can any one suggest me how to provide access to v$tables in oracle 10g to user .
its requried for auditor.
PLease help me.
regards

user12009184 wrote:
HI have to provide access to all V$ tables
it required for configuration of new tool.
ThanksYou can grant it the select catalog role to the user. It should provide all the required access to the general v$* & dba_* views.
GRANT SELECT_CATALOG_ROLE TO USER;
Let me know if this helps.
Regards,
Rizwan

How to access Data Guard option in Oracle 10g OEM

Hi All,
I have Oracle 10g ENTERPRISE EDITION on Unix envoirement. I want to setup logical standby Database through Data Guard technology. But when I brows through OEM I do not find Link for DATA GUARD????
1) How to access Data Guard option from oracle 10g OEM.
2) Does It come with Enterprise Edition OR I have to install it separately.
Regards,
Darshan

I am managing almost everything through EM Grid Control. It is easy to setup and configure.
Anyways, if you have read the documentation on
Oracle® Data Guard Concepts and Administration and setup your environment accordingly then you should not have any problems. Atleast I can assure you that your production database will not be affected by it.
Just make sure that you follow each step and read thoroughly. If you have spare machines then you can test and record your configuration before performing it on your production db. This link will provide you with the information on DataGuard.
http://download-uk.oracle.com/docs/cd/B19306_01/server.102/b14239/concepts.htm
If you think that way then you will never be able to do any new stuff since you will always fear that something might go wrong. Go ahead pal, try it on test machines and you will know that it is not that difficult.
There are real experts who help people like us in this forum and I know that they are doing a pretty good job.
All the best.
Rgds
Adnan

Getting Client IP address in Webcenter access log files

In addition to Understanding Webcenter Spaces Access Log File
I want to trace the IP address of the client machine from where webcenter spaces is being accessed.
How to capture this?
Please help.
-- Navin K

You can access one of two server logs:
If you embedded an HTTP Server in front of WebLogic (which is what Oracle recommends), then you have access information in OHS (which is just like Apace).
If you are using a managed server (or even the admin server) in WebLogic, same thing, different name/place (the http access log).
same discussions are going on in other thread -
How to get the IP adress of the user who have accessed Webcenter Spaces ?

Can I disable logging for session in Oracle 10g?

I use a procedure to delete a lot of row for an application repeatedly. Because the DELETE statement is time consuming and the data don't need to be archived, I decide to use the nologging option.
How to do it?
What is the best choice? Can I disable logging from session in Oracle 10g?
Thank you
Edited by: jetq on Jul 23, 2009 9:46 AM

Hi,
"Delete" without generating redo-log is not possible.
If you are on 10g, one way of making this thing efficiant is partition the table, with range-list partitioning. Partitioning existing table will be an excercise in itself, but that will be one time activity.
In partitioned (or sub-partitioned) tables, you can truncate a partition (or subpartition). That won't generate any redo log (or very very less redo log) and that runs in seconds.
In your case if you range partition INCOMING table by datetime (1 partition per day) and list sub-partition it by STATUS, that would help.
Another approach is, if you are deleteing, say 80% records every day and leaving 20% (or very less) records. What you can do is, partition the table only by range on datetime. Then, every time you want to delete data, copy the rows you want to keep in some other table (or temporary table), truncate partition for that day and insert rows back (which you want to keep).
I have done a similar thing and it works very quickly and generates very less redo log. Redo log generated in case of truncating partition or creating new partitions is just for Oracle internal commands (like data dictionary update etc).
Have fun.

How to Access Table Space Map in Oracle 10g OEM

How and from where to Access Table Space Map in Oracle 10g OEM ??
Thanks

Hi,
first of all, the online help system of grid control is outstanding. Just click on Help in the upper right corner and enter "Tablespace Extent Map" in the search form.
Result:
Show Tablespace Contents Page
Each Oracle database is divided into one or more logical units called tablespaces. You can use Oracle Enterprise Manager to manage these tablespaces and create or modify the parameters for the tablespaces. Use the Tablespace property sheet to set general and storage information for the specified tablespace.
Use the Show Tablespace Contents page to display the list of tablespace segments that comprise the existing tablespace. You can display Tablespace Extents by choosing Show Tablespace Extent Map at the bottom of the page. An extent is a logical unit of database storage space allocation made up of a number of contiguous data blocks. One or more extents in turn make up a segment. When the existing space in a segment is completely used, Oracle allocates a new extent for the segment.
You can view segment extents by clicking on the link in the Extents column to display the Extents in Segments page.
You can display the Show Tablespace Contents page by choosing Show Tablespace Contents from the command drop down list on the Tablespace property page, the Tablespace View page, or the Tablespace search results page.
Note: Developers could only display the tablespace map to a maximum hard coded number of 30,000 extents. Tablespaces are often larger than that. If a tablespace is larger than 30,000 extents, the portion over that is displayed as Unmapped. To avoid exceeding the memory capacity of the tablespace map and to display the map without unmapped extents, use a search criteria displaying results of less than 30K extents.
For an overview of tablespaces, see the "Overview of Tablespaces " chapter of the Oracle Database Concepts Guide.
For more information about managing tablespaces, see the " Managing Tablespaces" chapter of the Oracle Database Administrators Guide.
For more information about managing datafiles, see the " Managing Datafiles and Tempfiles" chapter of the Oracle Database Administrator's Guide.

Access Table Space Map in Oracle 10g EM

From where can I access Access Table Space Map in Oracle 10g EM?
Thanks

From where can I access Access Table Space Map in Oracle 10g EM?
Thanks

Putting header information on access log files

Can anybody suggest how to put a Apache Extended with Cookies LogFormat(i.e. "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"{User-Agent} i\"\"{Cookie}i\"") information in access log file headers in Oracle10g application server probably for webcache. I also want to know the location in which and where this configuration files resides.
Thanks,
Kamal

Are You using IronPort URL Filters or Cisco IronPort Web Usage Controls.
I'm using Cisco IronPort Web Usage Controlsand it shows:
IW_csec,-,"Unknown","-","Unknown","Unknown","-","-",462.00,0,-,"-","-">
Seems Your does not handle categorization and skips that part.

Authenticated user name not written to access log file

Our users are authenticated with certificates to an LDAP directory server. The Access log file is using the Extended-2 format.
The name of the authenticated user is now written in the Access log.
10.4.57.44 - - [19/May/2004:14:07:21 -0400] "GET /somepage HTTP/1.1" 200 10382
Anybody know why?

I've got the same problem with Sun Java System Web Proxy Server 4.02 for Linux.
When I installed it, authenticated users were visible in the access log. Then I tryied to change format and since that moment, this information is disappeared.
Any news about this bug?
Thanx.
G.

Extending HTTP access log file

I am trying to extend the HTTP access log file using the information given at http://e-docs.bea.com/wls/docs81/adminguide/web_server.html#113868
However, I havent been able to succeed in doing that. I have written my own class
authType.java to display that information in the log file. I compiled the class
and placed it under the lib directory thereby guaranteeing that it will be loaded.
However, the log file only seems to place a '-' at the location where it should
have actually placed the contents of the method getMethod().
Help will be appreciated.
[authType.java]

Not at the moment. We are working on adding a property in an upcoming
release.
This is documented at:
http://www.weblogic.com/docs51/adminhelp/AdminPropertyHelp.html
Thanks,
Michael
Michael Girdley
Product Manager, WebLogic Server & Express
BEA Systems Inc
Sean Scott <[email protected]> wrote in message
news:8fhpl1$50t$[email protected]..
Is there a property to set the max size of the http access.log file?

Regarding accessing log file entries in Oracle 10g

Similar Messages

Maybe you are looking for