Regd Audit Records

Hi Experts,
I m new to BASIS and need some suggestions on Audit Logs.
We usually look into audit logs in SM19 and SM20 for users who worked on the system based on a particular date as requested by the supervisor. (Maximum within 3 months of the present date)
Audit Information of a particular user is missing from this record who has actually logged into the system. (Confirmed based on certain operational evidence)
Is there any other way through which we can find the login and log out time of a particular user in SAP based on a particular date.
And is that a separate login and logout information maintained in SAP Netweaver Portal which is the interface through which the end user logs in our scenario
Regards
Anand Sekar

I would like to have a car but it is not allowed to have wheels nor a roof nor an engine. Actually it must look like a surf board...
Is there a standard functionality in SAP to do this?
Cheers,
Julius
ps: What you are looking for is the RFC type logins. Via RFC you can also access the system of attach the SAPGui after the successfull login (if the user type supports the SAPGui front end).
Access from Java stack is typically RFC.
You must also consider job which the user might have scheduled, which also process data... (sometimes at unusuall hours or after the owner of the user account has left the company,,,,).
You need to provide more details about your problem,
Edited by: Julius Bussche on Nov 5, 2011 12:00 AM

Similar Messages

While Installation of 11g database creation time error ORA-28056: Writing audit records to Windows Event Log failed Error

Hi Friends,
OS = Windows XP 3
Database = Oracle 11g R2 32 bit
Processor= intel p4 2.86 Ghz
Ram = 2 gb
Virtual memory = 4gb
I was able to install the oracle 11g successfully, but during installation at the time of database creation I got the following error many times and I ignored it many times... but at 55% finally My installation was hanged nothing was happening after it.....
ORA-28056: Writing audit records to Windows Event Log failed Error and at 55% my Installation got hung,,,, I end the installation and tried to create the database afterward by DBCA but same thing happened....
Please some one help me out, as i need to install on the same machine .....
Thanks and Regards

AAP wrote:
Thanks Now I am able to Create a database , but with one error,
When I created a database using DBCA, at the last stage I got this error,
Database Configuration Assistant : Warning
Enterprise Manager Configuration Failed due to the Following error Listener is not up or database service is not registered with it. Start the listener & Registered database service & run EM Configuration Assistant again....
But when I checked the listener was up.....
Now what was the problem, I am able to connect and work through sqlplus,
But I didnt got the link of EM and when try to create a new connection in sql developer it is giving error ( Status : failure - Test Failed the Network Adapter could not establish the connection )
Thanks & Regards
Creation of the dbcontrol requires a connection via the listener. When configuring the dbcontrol as part of database creation, it appears that the dbcontrol creation step runs before the dynamic registration of the databsase with the listener is complete. Now that the database itself is completed and enough time (really, just a minute or two) has passed to allow the instance to register, use dbca or emca to create the dbcontrol.
Are you able to get a sqlplus connection via the listener (sqlplus scott/tiger@orcl)? That needs to be the first order of business.

CRM 2011: when auditing is turned off, why do existing Audit records lose "New Value"?

Not sure if this is by design (if so, would love to know why!) or if this is a bug. Let's say I have auditing turned on for Accounts. I change the phone number in the Main Phone field from 555-1111 to 555-5555, and an audit record is
created showing the Old Value (555-1111) and New Value (555-5555). Great. Now I turn off auditing. The system goes back to the audit record that had previously been created, and modifies it so that it shows the Old Value (555-1111),
and inserts an icon into the New Value field indicating auditing was turned off. The tool tip for that icon states "Auditing was stopped and restarted. The new values for the fields that changed during this period cannot be identified or recorded."
First of all (minor picky issue) auditing hasn't been turned back on yet, despite what the tool tip says (says the same thing whether or not auditing is turned back on). But the real problem is
why the existing audit record's New Value would be removed... why would that happen?!? We're talking about a historical update. It really did change, and the system knew what it changed from/to, so why would the system remove that new value
from the audit record? Logically I would expect that any changes made
while auditing is off would not be logged, and that once auditing is turned back on, Old/New values would correspond to whatever was/is in the system at the time that any new audit record is created, so there may be a disconnect between an older audit
record and a new one (old record's New Value not matching the new record's Old Value, because changes were made while auditing was off). And it's quite apparent when auditing is turned off, because an audit record is created stating "Auditing Disabled".
Any ideas if there's a logical reason why it would do this, or if this is really a bug that Microsoft needs to fix? We have a client with a business need to periodically turn off auditing while integration updates run between CRM and another system
(otherwise hundreds of thousands of unnecessary audit records would be created). But if they're going to lose audit data every time they disable auditing, the auditing is worthless.

We wouldn't ever temporarily turn auditing off on purpose... it's happening when we import managed solutions. We have vendors with managed solutions that contain system entities such as Contacts. When importing their solution, it momentarily
turns auditing off on those entities. The only evidence of this is audit records indicating "Entity Audit Stopped", and of course the loss of all the most recent "new value" on all audit records. The interesting (?) parts of this are:
1. When importing the managed solution, the recommended option to keep all existing customizations is selected. I would think this would include the audit settings on the entity, but apparently not (sort of... see #2).
2. As soon as the managed solution is imported, in addition to creating an "Entity Audit Stopped" audit record on relevant entities and wiping out new values, it apparently turns auditing back on, yet there's no record of this (in customizations, the entity
still (or once again) indicates auditing is enabled; but on records for that entity, there is no "Entity Audit Enabled" record.
So, now it's on to working with the vendors, to dig into their managed solutions and see if there's a way to prevent this!

Fine Grained Audit records to syslog

Hello experts,
I am working on Standard Auditing and Fine Grained Auditing on 11.2.0.3 databases on Red Hat x86_64.
I am trying to send Fine Grained Audit records to syslog as for my Standard Audit records with audit_trail set to OS, but can't find any appropriate option.
When I create FGA policies with the ADD_POLICY procedure of the DBMS_FGA package, the audit_trail parameter can only be set to DB or XML, as stated in [PL/SQL Packages and Types Reference|http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_fga.htm#CDEIECAG].
Does somebody know if it is possible to send FGA audit records to syslog directly:
1. without using any additional product (e.g. Oracle Audit Vault)?
2. without doing manual extraction from fga_log$ or DBA_COMMON_AUDIT_TRAIL?
Thanks for any suggestion.

Hi,
Well, i did not used FGA yet.
I used audit_Trail=db and the query SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail WHERE to_char(extended_timestamp, 'DD/MM/RR') = to_char(SYSDATE - 1, 'DD/MM/RR') ORDER BY timestamp)
Then i wrote a procedure, and exported the results using utl_file .
And i scheduled this procedure to run daily.
It works pretty good, if you like the solution as ask for details.
Hope that helps,
Regards.

Oracle 11g R2 write audit record to application event log in Windows server

Hi,
I have a oracle 11g R1 database in windows 2003 server,
I set the init parameter audit_trail=db,extended,
but some auditing record still keep writting to windows application log
Event Type:     Information
Event Source:     Oracle.test
Event Category:     None
Event ID:     34
Date:          9/7/2011
Time:          3:36:38 PM
User:          N/A
Computer:     test
Description:
Audit trail: LENGTH: "226" SESSIONID:[7] "3875588" ENTRYID:[1] "1" USERID:[8] "test" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "1" LOGOFF$LREAD:[3] "755" LOGOFF$LWRITE:[2] "26" LOGOFF$DEAD:[1] "0" DBID:[10] "1613217480" SESSIONCPU:[1] "0".
Is there any way to disable this?
Thanks
Vincent

oh really, dont you say?
maybe next time read the whole note, not just the title
"In 11g these 'logoff by cleanup' audit records are not logged in DBA_AUDIT_TRAIL. The connection record remains as 'logon' record. It is not updated to 'logoff by cleanup'. *In these cases, the log off information like logoff_time, logoff_lread etc are written to an OS audit file as 'logoff by cleanup' audit record.* "

Error: Unable to insert new audit record for auditee 21 in repository UPA..

Hi,
I've got the error message below. Have you ever got this?
DEBUG [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.DATABASE - insert into UPA (UPA_KEY,usr_key,EFF_FROM_DATE,SRC,SNAPSHOT,DELTAS) values (?,?,?,?,?,?)
DEBUG [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.DATABASE - select UPA_seq.nextval from dual
ERROR [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.DATABASE - Class/Method: tcDataBase/writeStatement encounter some problems: ORA-01461: can bind a LONG value only for insert into a LONG column
java.sql.SQLException: ORA-01461: can bind a LONG value only for insert into a LONG column
     at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)
     at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:112)
     at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:173)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:413)
     at oracle.jdbc.driver.T4C8Oall.receive(T4C8Oall.java:1030)
     at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:194)
     at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:947)
     at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1222)
     at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3381)
     at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:3462)
     at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:1349)
     at weblogic.jdbc.wrapper.PreparedStatement.executeUpdate(PreparedStatement.java:159)
     at com.thortech.xl.dataaccess.tcDataBase.writePreparedStatement(Unknown Source)
     at com.thortech.xl.dataobj.PreparedStatementUtil.executeUpdate(Unknown Source)
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
ERROR [ACTIVE] ExecuteThread: '18' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.AUDITOR - Failed to process audit message
com.thortech.xl.audit.exceptions.AuditMsgProcessingFailedException: Unable to insert new audit record for auditee 21 in repository UPA
sert statement failed is: insert into UPA (UPA_KEY,usr_key,EFF_FROM_DATE,SRC,SNAPSHOT,DELTAS) values (?,?,?,?,?,?)
auditRepository=UPA_KEY; auditeeID=21
auditEpoch=2009-09-05 15:58:37.284; source=User: USER.TEST, API: com.thortech.xl.ejb.beansimpl.tcProvisioningOperationsBean, Method: updateTask
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by [Nested Exception]:
com.thortech.xl.orb.dataaccess.tcDataAccessException
     at com.thortech.xl.dataaccess.tcDataAccessExceptionUtil.createException(Unknown Source)
     at com.thortech.xl.dataaccess.tcDataBase.createException(Unknown Source)
     at com.thortech.xl.dataaccess.tcDataBase.writePreparedStatement(Unknown Source)
     at com.thortech.xl.dataobj.PreparedStatementUtil.executeUpdate(Unknown Source)
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by [Nested Exception]:
java.sql.SQLException: ORA-01461: can bind a LONG value only for insert into a LONG column
     at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)
     at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:112)
     at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:173)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)
     at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:413)
     at oracle.jdbc.driver.T4C8Oall.receive(T4C8Oall.java:1030)
     at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:194)
     at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:947)
     at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1222)
     at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3381)
     at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:3462)
     at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:1349)
     at weblogic.jdbc.wrapper.PreparedStatement.executeUpdate(PreparedStatement.java:159)
     at com.thortech.xl.dataaccess.tcDataBase.writePreparedStatement(Unknown Source)
     at com.thortech.xl.dataobj.PreparedStatementUtil.executeUpdate(Unknown Source)
     at com.thortech.xl.audit.genericauditor.utils.AuditDataHandler.write(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.updateAuditRecords(Unknown Source)
     at com.thortech.xl.audit.genericauditor.AuditMessageProcessor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.genericauditor.GenericAuditor.processAuditMessage(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processSingleAudJmsEntry(Unknown Source)
     at com.thortech.xl.audit.engine.AuditEngine.processOfflineNew(Unknown Source)
     at com.thortech.xl.audit.engine.jms.XLAuditMessageHandler.execute(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
     at com.thortech.xl.schedule.jms.messagehandler.AuditMessageHandlerMDB.onMessage(Unknown Source)
     at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
     at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
     at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
     at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
     at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
     at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
     at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
     at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)

Hello Peter:
Thanks! I tried to input two detail records and still get only one error.
I don't have pre/post trigger in my form. I use WHEN_BUTTON_PRESSED trigger with the following code:
if get_block_property('PARENT_DATA',status) = 'CHANGED' or
get_block_property('DETAIL_DATA',status) in ('CHANGED') then
COMMIT;
I also try File -> Save. It does not work either.
Do I need to pre/and post trigger to check for it? If so, please show me how.
Thanks again,
TD

What to audit and how to manage the audit records in oracle 11gr2

can anyone help me how to audit and manage the audit records in oracle 11gr2

867726 wrote:
can anyone help me how to audit and manage the audit records in oracle 11gr2
Hi,
I would recommend have a read this link for details http://download.oracle.com/docs/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#TDPSG50000
Cheers

How could I investigate SQL statement from standard audit record ?

We use Oracle 11gR2.
We use standard audit , audit_trail=DB.
We found suspicious audit record but that SQL_BIND,SQL_TEXT colums were NULL.
How could I investigate that SQL statement from standard audit record ?

Only "DB, EXTENDED" would cause the SQL statement to be captured.
If you have the Diagnostics Pack licence you could try querying DBA_HIST_SQLTEXT (joined to DBA_HIST_SNAPSHOT) -- but this would only list SQLs captured by AWR (i.e. the "Top 'N'" SQLs in that snapshot).
Hemant K Chitale

Multiple Audit Records created

We have seen that when executing certain workflows, IdM tends to log multiple audit records for the same task. This results in 2 identical records being created in the audit logs as seen in the Today's Report.
Can anyone help with understanding why this occurs and how to resolve this?

Frequently we see this behavior, and I'd love to know if there's a product issue that does this.
One reason we sometimes see duplicate entries is that IDM actually updates the account twice. E.g., if a workflow loads a user, checks the user in, then reloads the user and rechecks it in again later, we see two updates.
A common cause of double saves seems to be that IDM stores dates in memory in a different format than it does in the database, but IDM appears to compare the actual date values as strings. If you check out a view with a date in it, and then save it (without making any changes) the record is still treated as updated. E.g., "1 Jan 2009 10:00:00AM" in IDM memory vs. "01/01/2009 10:00:00" in the database.
But that only explains some of the duplicates we see.

Excessive audit record "Invalid token"

Excessive audit record "Invalid token" in audit database for one column occuring repeatedly can we know whats the reason behind this why it is caused and any way to resolve this ?

Hi Caroline,
Thanks for your reply.
Iam seeing directly in Audit database and for every 35 seconds and its being generated in column detail_text as "invalid token" simultaneously its showing in event_type_description as "user log on fails"
Please let me know what is the way to resolve it or what's reson behind this.
Regards,
Ram.

How to clean Audit records from OIM

Hi All,
I need to clean Audit records in OIM that are older than 15 months and I found out the following tables contains information about audits
1.UPA
2.UPA_FIELDS
3.UPA_GRP_MEMBERSHIP
4.UPA_RESOURCE
5.UPA_UD_FORMFIELDS
6.UPA_UD_FORMS
7.UPA_USR
How to develop script to delete the records older than 15 months?
Except UPA table, all other tables contain the column name "CREATE_DATE" & "UPDATE_DATE". what is the difference? and which one is required to implement above scenario?
Please guide me on the same...
Thanks in advance

Whenever you enable auditing the information about User Account Changes is captured in form of Snapshots and stored in the UPA table which would eventually flow to the remaining tales after being separated by normalizing this data using a post-processor internal to OIM auditing engine.
- So for remaining tables this is used moreover for reporting purposes in OIM. If you clear the data then the you know what you are doing ?
- Now for the primary table UPA you need to look for fields EFF_FROM_DATE & EFF_TO_DATE

Moving audit Records from one database to another database using dblink

i got five database, i have to move sys.aud$ records from five databases to one centralized database into another schema every day at 10:00 clock, i have to use a dblink for this, i have to create same table as sys.aud$ with different schema in centralized database with one extra column db_unique_name,by using db_link how i need to move records from all the five databases to one centralized database, can anyone help me here how to create a db_link from to move records from five database to one centralized database, due to maintainance perspective i have to move the records from all the five databases to one centralized database. i have to write a script for moving the audit records from all the five databases to one centralized database, can anyone help me how to write the script, or if you have any related scripts , can u post here, it will helpful for me.

spool audit.log
--"Auditing Initialisation Parameters: check initialization parameter"
select name || '=' || value from v$parameter where name like '%audit%'
---"if auditing is disabled then issue this command and bounce"
alter system set audit_trail=db,extended scope = spfile
shutdown immediate
startup
create tablespace ORDER_DATA datafile '+DDATA' size 50m;
create user INFO identified by INFO;
Grant connect,resource to INFO;
Alter user INFO quota unlimited on ORDER_DATA;
create table INFO.ORDER as select * from sys.aud$;
alter INFO.ORDER add db_unique_name varchar2(50);
create table INFO.ORDER
partition by range (Timestamp#)
subpartition by hash(dbid)
subpartition template
(subpartition sp1 tablespace users,
subpartition sp2 tablespace users)(
partition p1 values less than (TO_DATE('07/29/2010','MM/DD/YYYY')),
partition p2 values less than (TO_DATE('07/29/2011','MM/DD/YYYY')),
partition p3 values less than (MAXVALUE)) tablespace BGORDER_DATA as select * from sys.aud$
spool off;
exit
BEGIN
DBMS_SCHEDULER.create_job(
job_name => 'Move Aud$ records',
job_type => 'PLSQL_BLOCK',
job_action => 'CREATE OR REPLACE PROCEDURE bgorder_aud
                    AS
               ts TIMESTAMP;
               BEGIN
ts := SYSTIMESTAMP;
insert into info.order select * from sys.aud$ where timestamp# < ts;
delete sys.aud$ where timestamp# < ts;
commit;
END;
start_date => TRUNC(SYSDATE) + 22 / 24,
repeat_interval => 'FREQ=daily;BYHOUR=22;BYMINUTE=0;BYSECOND=0',
enabled => TRUE,
comments => 'Move records');
END;
/

OID: Where can I see audit records?

I just enabled some custom logging through Enterprise Manager for OID 11g, but I can't figure out where I can view the audit records. The documentation says the audit records are viewable through EM... Anyone know?

petrib wrote:
The developer site that phonehacker pointed you to has an "expert" search page (ugly and almost incomprehensible web form) that allows you to specify exact features, and then get a list of only devices that match those features.
http://www.developer.nokia.com/search/?view=ds
We've gone from one extreme to another
I'm not a developer and I have no clue what any of those terms mean. All I am looking for is a layman's comparison search and nothing to technical.
- Bluetooth Yes/No
- Email Yes/No
- WiFi Yes/No
- Quadband Yes/No
etc...

Add a new field in audit record?

All,
I want to add a required field to my forms that keys back to a change management system
When the forms are completed I would like the field to appear in the audit record for this action, with no history for previous existances of the new field (change a user record - new cm key in audit record).
I do not know how to get the new field on the audit record, can you help?
BTW, I am a fresh newbie, probably missing something obvious ;>)

You're asking a tall order. You need to do the following (in summary):
1) Figure out how to customize workflows
2) Figure out how to extract form variables into a workflow
3) Figure out how to generate a custom audit record.
Once you get to step three you can use the audit workflow server similar to the following:
<Action id='0' name='Audit Stuff' application='com.waveset.session.WorkflowServices'>
          <Argument name='op' value='audit'/>
          <Argument name='type' value='User'/>
          <Argument name='action' value='Login'/>
          <Argument name='resource' value='Some Resource'/>
          <Argument name='status' value='failure'/>
          <Argument name='parameters'>
            <map>
              <s>Param 1</s>
              <s>Value 1</s>
              <s>Param 2</s>
           <s>Value 2</s>
            </map>
          </Argument>
          <Argument name='name' value='some name'/>
          <Argument name='error' value='error message'/>
        </Action>Most of the custom message stuff can live in the parameters section. Sorry if that's vague but there's a ton of precursor steps before doing custom audit logs.
Edited by: MichaelF on Aug 6, 2008 1:32 PM

Aud$ and audit records...

Hi ,
We are going to be audited by an External auditing company. What we are expected to provide is a list of audit records(aud$) that indicate which objects were access by which users. I am able to extract this informtion selecting "SPARE1" from aud$, but there are instances where "SPARE1" is null.
Could anyone explain the justification for this?
How can I prove to the Auditor that this is an Oracle Application(OWB or OWF) audit record, if it is one?
Thank you.

Hello SailaV ,
You can do this but you will do this on the Schema level for example if a developer using the application and have access for hr schema and he deleted a record from the database how will you be able to prove he did that while all others using the same user and password.according to my knowledge you wont be able to do that with realms because realms will restrict users who are authorized as dba's from see all the information in the other schemas .i recommend that you implement user for every developer and give him/her new user with new password and leave the application user only for the application.
About how to use realms you need to read that chapter from the course database vault workshop.
kind regards
Mohamed

Regd Audit Records

Similar Messages

Maybe you are looking for