SGD 4.6 audit logging question

When using audit logging and filters, how often is a new log file automatically created? I'm interested in preserving the audit data and need to know when the file gets recreated.
Thanks.

By default, the logs are archived once a week via a crontab entry (Sunday, 0300, by default) - this option is set at install time, can be changed by running tarantella setup, or you can alter the crontab entry directly.
See "7.2.3.6 Automatic Log Archives" in the admin guide - http://docs.oracle.com/cd/E26362_01/E26354/html/sgd-installation.html#sgd-installation-full-restore and
http://docs.oracle.com/cd/E26362_01/E26354/html/tta-archive.html for a description of the archive command.
The archive command closes out the current log files, and compresses/summarizes them, and stores them in a numbered sub-directory under the "logs" directory, and opens news ones. Once closed out, you can no longer "query" the logfiles from the command line. Note that there are a limited number of archives maintained - 7 sets, I believe, is the default.
Have a look at the "archive" command under .../bin/scripts to see how it works.

Similar Messages

Feature Question - Audit Logging

Hello forum. Sorry if this is the wrong thread for this topic, but I was wondering if audit logging is a Standard Edition feature or if it's Enterprise only.
I can't find anything specifically saying that it is or isn't, and it's not enabled on my database so other than trying to enabling it and getting an error message (or not) I can't find an answer.
Sorry if this is a noob question, but I couldn't find anything about whether RMAN backup encryption was a Standard or Enterprise feature either, and it bit me in the ass when I found out it was Enterprise only.
Thanks in advance...

My apologies if you think I wasn't thorough enough in my own research before asking the question. I did do my own research using oracle's docs and google, and my final resource was the 10g Oracle Database Security Guide, which mentioned nothing about which versions supported which features.
I did post my original question yesterday morning and received no response. As you said, this is a volunteer forum, and I'm grateful for the assistance, but as sad as you think it is that I asked for an answer within a time frame, I was left with no choice. The question was posed to me yesterday morning and I needed to return an answer this afternoon.
In any event, thank you for the information.

ODSI 10Gr3 audit logs common/time question

Hi
With ODSI10GR3, We are investigating delays in processing of some DB2 Inserts
Inserst occur daily but th eproblem happens maybe once in a week
A review of the audit log during teh problem occurance shows the following
Comon/time is taking 33 seconds
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }
with compile time being ~ 14 sec and insert time being ~ 4 seconds
Is it possible that things such as full gc ooccuring can impact this time?
We increased tx timeout to 120 seconds to avoid the timeout but would like to investigate further on this.
Thanks Much for any info
Best
####<Mar 1, 2010 10:22:09 AM PST> <Info> <ODSI> <qa-sc-eibapp02.corp.test.com> <ds_ms2> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <service.uateibsads> <> <> <1267467729490> <BEA-000000> <ClientDataspace> <DSPAuditEvent timestamp: Mon Mar 01 10:21:36 PST 2010 severity: FAILURE id: ClientDataspace:48:Mon Mar 01 10:21:36 PST 2010 {
common/application {
user: service.uateibsads
name: ClientDataspace
eventkind: update
server: ds_ms2
query/performance {
compiletime: 14869
update/relational {
source: CBS_DB2_DS
sql: INSERT INTO "S109935E"."C@CR538"."C@CUNEW01" ("C@STATUS", "C@SEQNBR", "CUBK", "CUNBR", "CUSTAT",
"CUALT", "CUNA1", "CUNA2", "CUNA3", "CUNA4", "CUNA5", "CUNA6", "CUZIP", "CUZIP2", "CUZIP3",
"CUZIP4", "CUSHRT", "CUSSNR@", "CUSSTY", "CUCLPH", "CUHMPH", "CUBUPH", "CUPOFF", "CUSOFF",
"CUPOF1", "CUPOF2", "CUOPDT", "CUTYPE", "CUTYP", "CUSIC", "CUSEX", "CURACE", "CUOWN", "CUYREM",
"CUINC", "CUSRIN", "CUBDTE", "CUDEP", "CUCTC", "CUCTCT", "CUCIRA", "CUMNBR", "CUNTID", "CUUSR1",
"CUCLNK", "CUUSR3", "CUCDCH", "CUCDCN", "CUCDCD", "CUCMCH", "CUCMNR", "CUCMCD", "CUCVSH",
"CUCVCN", "CUCVCD", "CUCATH", "CUCATN", "CUCATD", "CUCLNG", "CUCCCD", "CULGLR", "CUCWHP",
"CUCPSP", "CUCTXN", "CUCPRF", "CUSHKY", "CUITLD", "CUPSTL", "CUACOM", "CUBRCH", "CUMIDT@",
"CUMRTS", "CUMAIL", "CUSOLI", "CUSOCI", "CUCPNA", "CUBPNA", "CUPERS", "CUSALU", "CUFAX",
"CUTELX", "CUTXAN", "CUDOCF", "CUDCDT", "CUTINU", "CUTADT@", "CUWPRT", "CUCECD", "CUCELM",
"CUEXTF", "CUMTND", "CUCNCD", "CUMARK", "CUEMPL", "CUINQ", "CUMNT", "CUCENS", "CUCODT", "CUDEDT",
"CUACCD", "CUBYR1", "CUBYR2", "CUPREF", "CUJBDT", "CUJDDT", "CUEMA1", "CUEMA2", "CUOPT",
"CUOPTD", "CUSPFG", "CUOENTTYP", "CUCENTTYP", "CUAMDT", "CUESDT", "CUENA1", "CUENA2", "CUENA3",
"CUENA4", "CUENA5", "CUENA6", "CUEPST", "CUEZIP", "CUEZIS", "CUEZP3", "CUEZP4", "CUAAPL",
"CUAAKY", "CUAREC", "CUASTA", "CUANA1", "CUANA2", "CUANA3", "CUANA4", "CUANA5", "CUANA6",
"CUAZP1", "CUAZP2", "CUAZP3", "CUAZP4", "CUAPSD", "CUASTR", "CUASTP", "CUASTS", "CUAFLG",
"CUARFG", "CUCLS", "CURISK", "CURDT1", "CURSK2", "CURDT2", "CUCRLN", "CUCRDT", "CUCRFR",
"CUCRND", "CUCRPR", "CUFSDT", "CUFSFR", "CUFSND", "CUSALE", "CUCSTS", "CUNETI", "CUPRJI",
"CUASST", "CUCURA", "CUCASH", "CUACCR", "CUMKTS", "CUREAL", "CULIFE", "CUINVN", "CUFIXA",
"CULIAB", "CUCURL", "CULTRM", "CUNETW", "CUDIRL", "CUINDL", "CUDIRT", "CUINDT", "CUREDB",
"CULCRO", "CUOTHA", "CUOTHL", "CU5WHP", "CUIWHY", "CUWHEX", "CUFILL", "CUREC1", "CUSTAD",
"CUFRN1", "CUCHIB", "CUCHID", "CUCLOB", "CUCLOD", "CUCCDD", "CUCDD1", "CUCDD2", "CUCHD1",
"CUCHD2", "CUCHP1", "CUCHP2", "CUCHP3", "CUCHP4", "CUCOL1", "CUCOL2", "CUCOL3", "CUCOL4",
"CUCCDT", "CUCCYD", "CUCTYD", "CUCIDB", "CUCDIR", "CUCIND", "CUCSEC", "CUCUNS", "CUCILD",
"CUCOPN", "CUCTOD", "CUCNON", "CUCHGO", "CUCRNB", "CUCQAG", "CUCQHU", "CUCQHI", "CUCQLO",
"CUCQDD", "CUCQDT", "CUDPD1", "CUDPD2", "CUDPD3", "CUDPDP", "CUDPD", "CUIPD", "CUUPD", "CUCAGY",
"CUCIAM", "CUCIAY", "CUCPAM", "CUCPAY", "CUCLTC", "CUCLSO", "CUUCMO", "CULCCA", "CUDRSD",
"CUFACS", "CUINDS", "CUIPDS", "CUSECS", "CUUNSS", "CUDPDS", "CUUCMS", "CUBDIR", "CUBCMO",
"CUTHR1", "CUTHR2", "CUTHR3", "CUTHR4", "CUTHR5", "CUFIV1", "CUFIV2", "CUFIV3", "CUFIV4",
"CUFIV5", "CUTEN1", "CUTEN2", "CUTEN3", "CUTEN4", "CUTEN5", "CUTWN1", "CUTWN2", "CUTWN3",
"CUTWN4", "CUTWN5", "CUTHI1", "CUTHI2", "CUTHI3", "CUTHI4", "CUTHI5", "CUSEV1@", "CUSEV2",
"CUSEV3", "CUSEV4", "CUSEV5")
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
rowsmodified: 1
time: 3655
common/application {
exception: Transaction timed out after 29 seconds
BEA1-000021E917F59C34B15A
update/service {
procedure: InsertNewCIF
arity: 1
dataservice: ld:CoreBankingSystem/LogicalServices/CreateNewCIF.ds
script: declare namespace ns0="ld:CoreBankingSystem/LogicalServices/CreateNewCIF";
declare namespace ns1="http://www.test.com/schemas/client/cbs/logical";
declare variable $__fparam0 as element(ns1:NewCIF)* external;
{ return value ns0:InsertNewCIF($__fparam0); }
common/time {
timestamp: Mon Mar 01 10:21:36 PST 2010
duration: 33323 }

1) Is it possible that there is a database lock preventing the insert from being committed?
2) What does the audit look like for a successful update?
3) Notice that the "compile time" is non-zero. This indicates that the plan was not cached. Likely because it is the first time this was executed after the server was started. So not only do you have the extra query compilation time, there would also be time for loading classes and other initialization. (but 12 seconds of loading an initialization seems like a lot). Given that increasing the tx time to 120 seconds solves the problem (it does solve the problem, doesn't it?) I would say that this is the issue.
4) Given that you just started the server (right? see (3)), it's not likely this is due to GC. But you could enable gc verbose to see.

Issue with Audit Log report in SharePoint 2010

I have enabled REPORTING feature at site collection level and configured the site collection audit settings. I tried to generated Audit log reports, most of the time it keeps on processing as shown in fig.It
keeps on processing, never comes to report generated successful message. how to overcome this issue?

i'm facing same issue, even when i tried to generate report for limited limited period(5 days) for a particular event(ex: delete or restore items (or) edit items).
I think, the below reference may guide you solve your issue
http://sharepoint.stackexchange.com/questions/17151/how-often-should-the-auditing-log-be-cleared-to-not-affect-performance
Sekar - Our life is short, so help others to grow
Whenever you see a reply and if you think is helpful, click "Vote As Helpful"! And whenever
you see a reply being an answer to the question of the thread, click "Mark As Answer

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

BOE XI 3.1 Removing Audit log files

Hi there experts,
we have an issue with our production BOE install (3.1 SP7) whereby we have over 39,000 audit log files awaiting processing in the BOE_HOME/auditing folder. These audit files were generated a few months back when we had an issue with the system whereby thousands of scheduled events were created, we are not sure how. The removal of these events has had a knock on effect in that we have too many audit files to process, ie the system just cant process them all quickly enough.
So my question is can we just remove these audit files from the auditing directory with no knock on effects as we dont need them loading into the audit database anyways as they are all multiples of the same event.
As an aside when we upgraded from SP3 to SP7 the problem went away, ie no new audit files for these delete events being generated. We are still to establish how/why these audit events were created but for the time being we just want to be able to remove them. Unfortunately as its a production system we don't want to just take a chance and remove them without some advice first.
thanks in advance
Scott

Is your auditing running now? Or still pending? Can you check in Audit DB, what is the max(audit_timestamp? This will tell you when was the recent actvitiy happened.
Deleting the audit files, will not harm to your BO system. You will not be able to see auditing details for that period.
Is the new auditing files are processed? or you still see the files created in auditing folder without processing?
If the auditing file size shows 0 okb, than it means they were processed.

Usage Report and Audit Log report showing different totals

I am trying to understand the differences displayed in two similar reports. The first report is an 'Audit Log' Report and it is displaying the number of Resource Account creations over a time period. The second report is a Usage Report using the exact same criteria (objectType = Resource Account and Action = Create). The totals I get back are VASTLY different. Can anyone explain? Is this a known bug?

Hi,
In any report we don't show the storage policies information. In Cost report if the storage policies have different rate factors then we will show the split for the storage information. But in usage report , rate factors will not be applicable as we don''t show the cost details. Hope this clarifies your question. Please let us know if you need more information.
Thanks,
Lakshmi

Audit log + manual update + specify download location

Hi all,
I'm evaluating whether we can use Java Web Start for our new product, for geographically distributed software deployment.
I've the following questions that I could not find answers in the official documentation:
- Can it support manual update? i.e. is there any way I can put a button on the application UI so that instead of checking latest version on every program start, the end-user can manually initiate software update.
- Can I extend it to support audit log? i.e. we need to keep track of which client upgrade to which version in a centralized database (as audit trail), and when such update occurred. Can we do this?
- Some of our end-user has no access to local filesystem, they only have access to dedicated shared network drive, can we customize Web Start so that it download and save the new version to a specific location, instead of C:\temp?
- We have a few jar files for the application. How can we ensure that all jar files are either updated, or not updated at all? i.e. kind of transaction concept.
- One of the jar files contains some configuration files, which need to be expanded in exploded format (to allow runtime change of configuration options). How can we do that?
Thanks a million.

Hi all,
I'm evaluating whether we can use Java Web Start for
our new product, for geographically distributed
software deployment.
I've the following questions that I could not find
answers in the official documentation:
- Can it support manual update? i.e. is there any
way I can put a button on the application UI so that
instead of checking latest version on every program
start, the end-user can manually initiate software
update.currently, no - this is a requested feature being considered for 6.0
>
- Can I extend it to support audit log? i.e. we need
to keep track of which client upgrade to which
version in a centralized database (as audit trail),
and when such update occurred. Can we do this?only by controling a servlet or jsp page that generates the jnlp file and keeps track of what requests are made for the jnlp file and the resources of the app. Java Web Start itself runs on the client machine.
>
- Some of our end-user has no access to local
filesystem, they only have access to dedicated shared
network drive, can we customize Web Start so that it
download and save the new version to a specific
location, instead of C:\temp?webstart itself only downloads into its own cache (by default on windows XP at c:\Doccuments and settings\<user name>\Application Data\Sun\java\deployment\cache\javaws
this cache location can be configured.
in version 6.0 we will have capability to disable caching, but curent version must have a cache.
>
- We have a few jar files for the application. How
can we ensure that all jar files are either updated,
or not updated at all? i.e. kind of transaction
concept.
Java web Start currently checks timestamps of all downloaded jars before launching application, and will only update all or none.
- One of the jar files contains some configuration
files, which need to be expanded in exploded format
(to allow runtime change of configuration options).
How can we do that?If you must access these resources as files, you will have to extract them using ClassLoader.getresourceAsStream(), and then write them to disk yourself.
>
Thanks a million./Andy

Audit Log Management

I cannot get my Audit Log Management job to run. It fails because "Invalid audit archive path. Please check your setting." Where do I check the setting? I am running 5.0.3 with Collab 4.0. Thanks.

Just an FYI, with ZDM 6.5 HP3 the file name changed from AuditLog.txt to
ZRMAudit.txt still located under system32 on Windows XP.
Jim Webb
>>> On 5/22/2006 at 3:27 PM, in message
<[email protected]>,
Jim Webb<[email protected]> wrote:
> Well I found out the ZDM 6.5 HP2 fixes the problem of the log file not
> being
> created.
>
> Jim Webb
>
>>>> On 5/19/2006 at 8:37 AM, in message
> <[email protected]>,
> Jim Webb<[email protected]> wrote:
>> Well, it does show up in the event log but not in the inventory. If I
>> disable inventory the log file won't be deleted, correct?
>>
>> Jim Webb
>>
>>>>> On 5/18/2006 at 10:03 AM, in message
>> <[email protected]>, Marcus
>> Breiden<[email protected]> wrote:
>>> Jim Webb wrote:
>>>
>>>> I did a search on a machine I am remote controlling, no log file. What
>>>> next?
>>> good question... does the session show up in the eventlog?

Audit log web service for Office 365

I am working on developing an application that will interact with the Office 365 services. I am currently able to get the files and folders of a singed-in user using the OAuth2 authentication. I am aware that we can get the audit logs and it will be exported
to Microsoft Excel.
However, my question is : Is there any web service or endpoint I can use to access the logs using REST API. For example, Box provides an api/endpoint to achieve this: http://developers.box.com/docs/#events.
Any help would be highly appreciated!
Many Thanks

Currently displaying audit log reports in REST or API is not supported by Microsoft. SharePoint online in Office 365 just supports saving an audit log report as a Microsoft Excel 2012 Preview workbook.
You can refer the following post :
http://community.office365.com/en-us/f/172/t/164047.aspx

Audit log settings in CUCM

Hi all. I'm running CUCM 8.6.2 and I have some questions about the Audit Log Configuration in Serviceability that I'm not finding clear answers for in the documentation here: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/service/8_6_1/admin/serviceability/saaulog.pdf
Specifically:
-What exactly is the difference between the Remote Syslog Audit settings and the Database Audit Log Filter Settings? We're trying to send logs to Splunk of changes made on the CUCM without seeing every time applications like TMS authenticate to the CUCM, which is more or less constantly.
-When the Server Name is set in the Remote Syslog field, and Enable Audit Log is checked in Database Audit Log Filter Settings, does the DB audit log get sent to this IP as well?
Thanks

Hi Rajesh,
Doesnt work for me :(((
404 Not Found
The requested resource /messagingsystem/monitor/monitor.jsp is not available
Details: File [messagingsystem/monitor/monitor.jsp] not found in application root of alias [/] of J2EE application [sap.com/com.sap.engine.docs.examples].
Thanks.
Regards,
Shweta

Automatic User Device Affinity - Audit logs retention

Hello,
We have problems on generating primary user info on a lot Computers and we suspect that problem is because audit logs are kept for too short time.
So the config is following:
1) User device affinity threshold (minutes): 2880
2) User device affinity threshold (days): 30
So there are two questions:
1) For how long do we need to keep audit logs on SCCM client to successfully generate user device affinity;
2) How long do we need to wait till information populates in SCCM DB?
Thanks,
Pēteris

Also from UserAffinity.log I can see that information is sent with state messages:
"Found same state message existing. (was sent before) Skip sending same state message for user"
Hi,
You could try to delete state message about the user in WMI on a client to see if user device affinity could be populated. That is stored in root\ccm\statemsg -> Enum Classes -> Recursive -> double-click CCM_StateMsg -> Instances. There
should be messages that contain "domain/user_Auto".
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Trace level of RWB's Message Monitoring - Detail Message - Tab "Audit log"

Hi,
My flow is: File -> PI -> Transformed File with seeburger module. Everything is good except the trace level in RWB.
Exactly, in our PI production, under RWB -> Message Monitoring, when I select a message (e.g PI -> Outside) and see its Detail, under tab "Audit Log", I have a log with only 2 pages (which corresponds to the sender part "File -> PI")... whereas in our PI pre-production, I have 4 pages for the exact same flow, on which I have also info of the receiver part "PI -> Outside"...
My question is just: do you know which parameter is involved in this trace level of RWB's Message Monitoring Detail log ?
regards.
Mickael
Note: in [Help SAP|http://help.sap.com/saphelp_nw04/helpdata/en/fd/16e140a786702ae10000000a155106/frameset.htm], I see only this sentence "Audit Log: The audit log for the selected message is displayed as the default setting.".
Edited by: Mickael Huchet on Oct 18, 2011 1:59 PM

Hi Shabarish,
Thanks that will help to localize my search.
else by hazard, you don't know which parameter in this tree is for the "Audit Log"?
coz I did a quick look in prod and pre-prod, but it seems the severity is the same (e.g "Info" for most of them) whereas the trace level of "Audit log" is different.
Thanks for
Regards.

Fetching Audit log from sm20 tr-cd

Dear guys,
I am asking this question from quiet long time..
but no body replies with enough information....could somebody plz tell me,is this something vague job to do or my explanation is insufficient.?
i debugged the code at SM20 program too..but i could not observe the suitable FM to fetch audit log texts and put in Internal tableshortly.Even though i went thru SECU FGroup..saw audit log related FMs.
could somebody follow this post..i could reward points once i get answer for my question.
Thanks in advance.
ambichan

Hi,
You can activate the internal audit system by setting the audit log parameters as described in the following table :
Audit Log parameter settings Audit Log Parameter Set value to...
rsau/enable 1
rsau/local/file path to audit log file
rsau/max_diskspace/local maximum space to allocate for the audit files
rsau/selection_slots 3
rec/client ALL
Thanks,
Hamendra

SGD 4.6 audit logging question

Similar Messages

Maybe you are looking for