OWCC and reviews audit trail

Similar Questions

• 11 GR 2: periodically purge the question of audit trail

  Hello
  
  I have a question about automatic and periodically audit trail is serving to 11g.
  
  I went through the docs and went ahead scheduling periodic purge of my audit trail based on archive timestamp.
  
  Here are the steps I did:
  
  (1) run dbms_audit_mgmt.init_cleanup
  (2) run dbms_audit_mgmt.set_last_archive_timestamp as follows:
  

  SQL>begin
   2  dbms_audit_mgmt.set_last_archive_timestamp(
   3  audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
   4  last_archive_time => SYSTIMESTAMP-365);
   5  end;
   6  /

  (3) created a purge with dbms_audit_mgmt.create_purge_job job that uses the timestamp of set_last_archive_timestamp
  
  
  That went well, and the first work of purge delete all records of 365 days. But I expect I would be the timestamp increment any, so that the recurring task always deletes records older than systimestamp-365.
  But this does not happen and the initial date of SYSTIMESTAMP-365 remains on the original date.
  Am I supposed to run dbms_audit_mgmt.set_last_archive_timestamp every time before work to purge itself?
  
  Thanks a lot for any advice / experience on this. :)

  Hi AJ,.
  set_last_archive_timestamp is considered to be the last stage of the audit manual archiving data. Doc States:

  This procedure sets a timestamp that indicates when the audit records were finally archived. The Director of audit provides the time stamp to affix the audit records. The CLEAN_AUDIT_TRAIL procedure uses this timestamp to decide on audit records should be deleted.

  So you have to run set_last_archive_timestamp on a regular basis and thus confirm the audit data archiving.

  CREATE_PURGE_JOB calls CLEAN_AUDIT_TRAIL which checks archive timestamp of last call of set_last_archive_timestamp.

  In short, yes call set_last_archive_timestamp each time before purge jobs runs or working purge purge more recent verification of data.

  Concerning
  Martin

• Using the Audit trail for audit rollback and commit?

  Hello

  Although not always relevant because a "failure" session/program can issue a commit or a rollback, is possible to audit the validations and cancellations using the Audit trail?

  Thank you and best regards.

  
  

  Yes, 12 c.

• Do not get the audit trail for oracle solaris running. It starts and then stops after a few seconds. How can I set up a secure target Oracle Solaris? cure

  I have installation BSM on my solaris 10 Server. I configured BSM to be sent to syslog. I registered my target secure on the server of the AV type Oracle Solaris. Add an audit trail of pointing to the syslog file. The Audit Trail starts and stops after a few seconds. the error I get from the agent log is

  [2014 11-25 T 11: 36:38.647 + 02:00] [collfwk] [ERROR] [] [] [tid: 10] [ecid: 192.169.1.50:11353:1416908198895:0, 0] FVO-8015: initialization of the instanceCollectionController AuditEventCollector error: run: process() Exception. [[

  Instance of Error initializing AuditEventCollector

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.initialize(CollectionController.java:322)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.process(CollectionController.java:402)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.run(CollectionController.java:350)

  at java.lang.Thread.run(Thread.java:662)

  Nested exception:

  java.lang.NumberFormatException: for input string: "invalid audit trail: / var/adm."

  at java.lang.NumberFormatException.forInputString(NumberFormatException.java:48)

  at java.lang.Integer.parseInt(Integer.java:449)

  in java.lang.Integer. < init > (Integer.java:660)

  to oracle.av.platform.common.exception.AuditException. < init > (AuditException.java:118)

  to oracle.av.platform.agent.collfwk.AuditEventCollectorException. < init > (AuditEventCollectorException.java:59)

  at com.oracle.solaris.SolarisCollector.initializeCollector(SolarisCollector.java:86)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.initialize(CollectionController.java:316)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.process(CollectionController.java:402)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.run(CollectionController.java:350)

  at java.lang.Thread.run(Thread.java:662)

  ]]

  [2014 11-25 T 11: 47:49.248 + 02:00] [collfwk] [ERROR] [] [] [tid: 11] [ecid: 192.169.1.50:11353:1416908869249:1, 0] FVO-8015: initialization of the instanceCollectionController AuditEventCollector error: run: process() Exception. [[

  Instance of Error initializing AuditEventCollector

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.initialize(CollectionController.java:322)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.process(CollectionController.java:402)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.run(CollectionController.java:350)

  at java.lang.Thread.run(Thread.java:662)

  Nested exception:

  java.lang.NumberFormatException: for input string: "invalid audit trail: / var/audit.

  at java.lang.NumberFormatException.forInputString(NumberFormatException.java:48)

  at java.lang.Integer.parseInt(Integer.java:449)

  in java.lang.Integer. < init > (Integer.java:660)

  to oracle.av.platform.common.exception.AuditException. < init > (AuditException.java:118)

  to oracle.av.platform.agent.collfwk.AuditEventCollectorException. < init > (AuditEventCollectorException.java:59)

  at com.oracle.solaris.SolarisCollector.initializeCollector(SolarisCollector.java:86)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.initialize(CollectionController.java:316)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.process(CollectionController.java:402)

  at oracle.av.platform.agent.collfwk.impl.controller.CollectionController.run(CollectionController.java:350)

  at java.lang.Thread.run(Thread.java:662)

  ]]

  Can you please help with instructions/solution implementation of Oracle Solaris secure target? A beginner in Audit Vault.

  I have the installation path for the database and which works very well

  concerning

  Thanks for the pointers. After you add hostname to the location of the trail, the audit trail is running

• He had to capture the old value and new values using the oracle audit trail

  Hello
  
  I put the parameter audit_trail for db, extended. I am in treatment of the LMD. I need to display the values changed by these instructions DML audit trail stored in dba_audit_trail. How can I achieve the same?
  
  Kindly guide me.

  If you want images of column of the table target before and after then the native audit function is probably not your best option. I think that you want to set triggers to audit for the insert tables and write either the CDC or duplicate lines in a historical table of change.

  HTH - Mark D Powell.

• VPN audit trail

  NetPro dear friends,

  I use Cisco ACS 5.1 to authenticate VPN users that connect to our servers. Some users connect to the database, some connect to web services, etc. Is there a feature or function ACS from the inside audit trail users to keep track of what they did while they were connected. If this isn't the case, so please guide me what third-party device or software to use for this.

  Thanks and greetings

  Faiz

  You can use the Balabit Shell control box to record all activities

• Options of alias for POV while implementing the data audit trails

  Hi all

  I have a request to implement the option Alias for the account dimension, which gets exported to the HSP_AUDIT_RECORDS table when the Audit trail for data is enabled.

  In the column of ID2, user want to see Alias name of the Member account.

  Do we not have this feature?

  Kind regards

  NGO

  Audit records will still be stored with the name of the Member, not alias, to do this, you will need to do a post on the table processing and replace the names of the members with the alias, I don't know any other way to get.

• Another audit trail is not purged.

  Oracle 11.2.0.3 SE - One

  Oracle Linux 5.6 x 86-64

  I seem to have a problem very similar to that described in thread https://community.Oracle.com/thread/3574919

  Went through the usual steps of moving tables to audit a dedicated TS and the initialization of audit management infrastructure.  Working on 3 different databases on a test server, two work exactly as planned but the third (rman duplicate every weekend production) is not purge.

  Here is the testimony of the installation.  For display, I changed the names of database a simply DB1, DB2, DB3.  Those designated as DB3 is the "enfant terrible".

  SQL > select name from v$ database;

  NAME

  ---------

  DB1

  1 selected line.

  SQL > SET SERVEROUTPUT ON

  SQL > START

  2. IF DBMS_AUDIT_MGMT.is_cleanup_initialized (DBMS_AUDIT_MGMT. AUDIT_TRAIL_DB_STD) THEN

  3 DBMS_OUTPUT.put_line ('YES');

  4 SOMETHING ELSE

  5 DBMS_OUTPUT.put_line ('NO');

  6 END IF;

  7 END;

  8.

  YES

  PL/SQL procedure successfully completed.

  SQL > SELECT * FROM dba_audit_mgmt_config_params;

  PARAMETER_NAME, PARAMETER_VALUE AUDIT_TRAIL

  ------------------------------ -------------------- --------------------

  STANDARD DB TABLESPACE AUDIT_TRAIL AUDIT AUDIT TRAIL

  FGA DB TABLESPACE AUDIT_TRAIL AUDIT AUDIT TRAIL

  AUDIT OF AUDIT FILE MAX TRAIL SIZE 10000 OS

  CHECKING FILE MAX SIZE 10000 XML AUDIT TRAIL

  AUDIT FILE MAX 5 YEARS AUDIT TRAIL OS

  AUDIT FILE MAX 5 YEARS AUDIT TRAIL XML

  DB AUDIT OWN LOT SIZE 10000 AUDIT STANDARD

  DB AUDIT OWN LOT SIZE 10000 FGA AUDIT TRAIL

  1000 OS OS OWN BATCH FILE AUDIT TRAIL SIZE

  OS OWN BATCH FILE AUDIT TRAIL SIZE 1000 XML

  DEFAULT CLEANUP INTERVAL 24 STANDARD AUDIT TRAIL

  PARAMETER_NAME, PARAMETER_VALUE AUDIT_TRAIL

  ------------------------------ -------------------- --------------------

  DEFAULT CLEANUP INTERVAL 24 FGA AUDIT TRAIL

  DEFAULT CLEANUP INTERVAL 24 OS AUDIT TRAIL

  DEFAULT CLEANUP INTERVAL 24 XML AUDIT TRAIL

  14 selected lines.

  SQL >

  SQL > exit

  < snip >

  SQL > select name from v$ database;

  NAME

  ---------

  DB2

  1 selected line.

  SQL > SET SERVEROUTPUT ON

  SQL > START

  2. IF DBMS_AUDIT_MGMT.is_cleanup_initialized (DBMS_AUDIT_MGMT. AUDIT_TRAIL_DB_STD) THEN

  3 DBMS_OUTPUT.put_line ('YES');

  4 SOMETHING ELSE

  5 DBMS_OUTPUT.put_line ('NO');

  6 END IF;

  7 END;

  8.

  YES

  PL/SQL procedure successfully completed.

  SQL > SELECT * FROM dba_audit_mgmt_config_params;

  PARAMETER_NAME, PARAMETER_VALUE AUDIT_TRAIL

  ------------------------------ -------------------- --------------------

  STANDARD DB TABLESPACE AUDIT AUDIT TRAIL

  FGA DB TABLESPACE AUDIT AUDIT TRAIL

  AUDIT OF AUDIT FILE MAX TRAIL SIZE 10000 OS

  CHECKING FILE MAX SIZE 10000 XML AUDIT TRAIL

  AUDIT FILE MAX 5 YEARS AUDIT TRAIL OS

  AUDIT FILE MAX 5 YEARS AUDIT TRAIL XML

  DB AUDIT OWN LOT SIZE 10000 AUDIT STANDARD

  DB AUDIT OWN LOT SIZE 10000 FGA AUDIT TRAIL

  1000 OS OS OWN BATCH FILE AUDIT TRAIL SIZE

  OS OWN BATCH FILE AUDIT TRAIL SIZE 1000 XML

  DEFAULT CLEANUP INTERVAL 24 STANDARD AUDIT TRAIL

  PARAMETER_NAME, PARAMETER_VALUE AUDIT_TRAIL

  ------------------------------ -------------------- --------------------

  DEFAULT CLEANUP INTERVAL 24 FGA AUDIT TRAIL

  DEFAULT CLEANUP INTERVAL 24 OS AUDIT TRAIL

  DEFAULT CLEANUP INTERVAL 24 XML AUDIT TRAIL

  14 selected lines.

  SQL >

  SQL > exit

  < snip >

  SQL > select name from v$ database;

  NAME

  ---------

  GBP

  1 selected line.

  SQL > SET SERVEROUTPUT ON

  SQL > START

  2. IF DBMS_AUDIT_MGMT.is_cleanup_initialized (DBMS_AUDIT_MGMT. AUDIT_TRAIL_DB_STD) THEN

  3 DBMS_OUTPUT.put_line ('YES');

  4 SOMETHING ELSE

  5 DBMS_OUTPUT.put_line ('NO');

  6 END IF;

  7 END;

  8.

  YES

  PL/SQL procedure successfully completed.

  SQL > SELECT * FROM dba_audit_mgmt_config_params;

  PARAMETER_NAME, PARAMETER_VALUE AUDIT_TRAIL

  ------------------------------ -------------------- --------------------

  STANDARD DB TABLESPACE AUDIT AUDIT TRAIL

  FGA DB TABLESPACE AUDIT AUDIT TRAIL

  AUDIT OF AUDIT FILE MAX TRAIL SIZE 10000 OS

  CHECKING FILE MAX SIZE 10000 XML AUDIT TRAIL

  AUDIT FILE MAX 5 YEARS AUDIT TRAIL OS

  AUDIT FILE MAX 5 YEARS AUDIT TRAIL XML

  DB AUDIT OWN LOT SIZE 10000 AUDIT STANDARD

  DB AUDIT OWN LOT SIZE 10000 FGA AUDIT TRAIL

  1000 OS OS OWN BATCH FILE AUDIT TRAIL SIZE

  OS OWN BATCH FILE AUDIT TRAIL SIZE 1000 XML

  DEFAULT CLEANUP INTERVAL 24 STANDARD AUDIT TRAIL

  PARAMETER_NAME, PARAMETER_VALUE AUDIT_TRAIL

  ------------------------------ -------------------- --------------------

  DEFAULT CLEANUP INTERVAL 24 FGA AUDIT TRAIL

  DEFAULT CLEANUP INTERVAL 24 OS AUDIT TRAIL

  DEFAULT CLEANUP INTERVAL 24 XML AUDIT TRAIL

  14 selected lines.

  SQL >

  SQL > exit

  Here are the guts of the purge script

  Conn / as sysdba

  ALTER session set nls_date_format = 'DD-MON-YYYY HH24:MI:SS ";

  Select the name,

  SYSDATE RUN_TIME

  from v$ database;

  --

  Select count (*) audit_recs,

  min (timestamp) oldest.

  Max (timestamp) new

  of dba_audit_trail;

  --

  BEGIN

  DBMS_AUDIT_MGMT. SET_LAST_ARCHIVE_TIMESTAMP (DBMS_AUDIT_MGMT. AUDIT_TRAIL_AUD_STD, TRUNC (SYSTIMESTAMP)-90);

  DBMS_AUDIT_MGMT. SET_LAST_ARCHIVE_TIMESTAMP (DBMS_AUDIT_MGMT. AUDIT_TRAIL_FGA_STD, TRUNC (SYSTIMESTAMP)-90);

  DBMS_AUDIT_MGMT. SET_LAST_ARCHIVE_TIMESTAMP (DBMS_AUDIT_MGMT. AUDIT_TRAIL_OS, TRUNC (SYSTIMESTAMP)-90);

  DBMS_AUDIT_MGMT. SET_LAST_ARCHIVE_TIMESTAMP (DBMS_AUDIT_MGMT. AUDIT_TRAIL_XML, TRUNC (SYSTIMESTAMP)-90);

  END;

  /

  --

  BEGIN

  DBMS_AUDIT_MGMT. CLEAN_AUDIT_TRAIL (DBMS_AUDIT_MGMT. AUDIT_TRAIL_ALL, TRUE);

  END;

  /

  --

  Select count (*) audit_recs,

  min (timestamp) oldest.

  Max (timestamp) new

  of dba_audit_trail;

  --

  and here are the results of the problem child

  Modified session.

  NAME RUN_TIME

  --------- --------------------

  DB3 24 JUNE 2014 08:05:01

  AUDIT_RECS MOST RECENT FORMER

  ---------- -------------------- --------------------

  3535812 17 JUNE 2013 02:45:49 JUNE 24, 2014 08:01:33

  PL/SQL procedure successfully completed.

  PL/SQL procedure successfully completed.

  AUDIT_RECS MOST RECENT FORMER

  ---------- -------------------- --------------------

  3535812 17 JUNE 2013 02:45:49 JUNE 24, 2014 08:01:33

  As usual, I'm sure I have forgotten any essential difference between the 'good' and 'bad', but it eludes me.

  > but the third (rman duplicate every weekend production) is not purge.

  If the DBID changed?

  See footnote support Oracle #1431343.1

  Hemant K Collette

• Audit trail is not purged.

  Hello

  my current database version is 11.2.0.3.0. I am currently serving my with a procedure audit trail. In my home, I had this part of the code:

  SYS.dbms_audit_mgmt.clean_audit_trail( audit_trail_type  =>  SYS.dbms_audit_mgmt.audit_trail_aud_std, use_last_arch_timestamp => TRUE );

  I'm not under the procedure under SYS so there... in SYS.dbms code. Everything works without errors. But the table of sys.aud audit trail $ is not purged!

  Any ideas why it doesn't work?

  I read that: Bug 9164488 - DBMS_AUDIT_MGMT. CLEAN_AUDIT_TRAIL does not delete the tables sys.aud$ and sys.fga_log$ ID 9164488.8 + has been fixed in 11.2.0.2 version, so this should not be the case.

  Also last setting archive timestamp works very well!

  SYS.dbms_audit_mgmt.set_last_archive_timestamp( audit_trail_type  => SYS.dbms_audit_mgmt.audit_trail_aud_std, last_archive_time => to_timestamp(SYSDATE - pocet_dnu), rac_instance_number  => null ); 

  Thank you

  Honza

  See Support of Oracle 1431343.1 Note for a possible cause.

  Hemant K Collette

• Can I sent some info custom as the name of the db in my audit standard audit trails?

  Hello

  I want to register my audit trails db name while doing a standard audit. Audit process can you provide some contexts custom as the name of the comic?

  Hello

  In 11 GR 2, the only custom value that can be set and which is also found in the audit trail is the aud$ .clientid that you can set with dbms_session.set_identifier.

  in 12 c with Unified audit there is a new feature to include data of application context in the audit trail to the statement of VERIFICATION OF NAMES of CONTEXT,

  Greetings,

  Damage ten Monkshood

• How can I send a company of "the password audit trail" for a doc to e-sign?  They want to check it for their records. Thank you!

  
  I have need help send the 'audit trail of password for a document. A company, we work with will not accept the pdf of the signed document copy.

  Thank you.

  Hello

  You can find your report via the tab manage point culminating the document in question and select the history tab (on the right side). You will then see the option of audit report.

  Thank you

• Apex - with the external database audit trail

  I'm currently installing a primitive audit trail that allows me to record data, create users, update, update user. I currently have 3/4 but I can not get the user name in the database like V ('APP_USER') is at the top and the database in Oracle 10 G elsewhere.

  Suggestions or alternative ideas?

  f1f7a787-7f56-4451-8300-5a9a0215226b

  If v() and apex_application.g_user are not available in the trigger on the external database code.

  But the external database package variables and procedures are available on the database running APEX.

  What I would do, is to create a package with a package variable that will contain the user of the apex. (in the external database)

  Then, in the application definition > session database > initialization code PL/SQL defined this package to the apex user variable.

  Clear the package again variable in the cleanup code.

  Using a package variable means that the value is aviable at the session of entire database but not outside the East.

  Apex every page load or submit and load next page is a database session.

  Now the package variable will be set when a user of the apex and the null value when there is a database user.

  Using an nvl around the package with user variable as an alternative, will give you the user apex when the action was made by a user of the apex and the database user is not.

  Nicolette

  PS change your handle or at the signing of all least your post will result in a more friendly welcome message.

• Audit trail Tables should be in SAMS tablespaces in 9i / 10g?

  Hello
  
  I know that a strong recommendation for 11g is that we house the SYS. AUD$ and SYS. FGA_LOG$ table in a tablespace SAMS and certainly NOT the system tablespace.
  
  However, I am struggling to find anywhere where it says the same for previous versions of the database - specific 9i and 10g.
  
  I thought I had read somewhere that Oracle do not support move the tables out of the SYSTEM tables audit trail in previous versions, but I can't find where I read that.
  
  Basically, I presume I can create a tablespace of VERIFICATION that uses the SAMS and move the tables on 9i / 10g? (Yes, I know things being out-of-support - application vendor has not yet certified 11 g!)
  
  Mark

  Erman Arslan says:
  Yes... interesting... maybe he can perform certain operations such as upgrade version and that is why it s not supported...

  But knowing how do has been public knowledge for several versions and is very common. I have been at this since 7.3 and have never heard a question resulting from travel sys.aud$ and he associated with the index another tablespace. And that's really it, that is. If you look at the script "unsupported" provided by oracle, you will set it's just move a table and rebuild its indexes. No tricks Super hidden guru.

  The question is not SAMS vs non-SAMS. It is a very volatile table of the TS system.

• Configuration of the audit trail of data

  Hello
  
  I am brand new with Hyperion Planning/Essbase and I'm trying to implement an audit trail of data. I already turned on the audit data in the workspace-> Navigate-> Applications-> planning-> DBName-> Administration-> Application reports. I also downloaded SQLDeveloper in my laptop and have it operational. However, I can not understand how to connect with Hyperion Planning/Essbase. Is there documentation on how to setup the connection? Any help will be greatly appreciated.
  
  Thank you

  If you go into the administration of planning and change the data source for your application, then it should provide all the connection information.
  In SQLdeveloper add a new connection and enter the details of the data source to connect to the schema and expand tables and view or query the data in HSP_AUDIT_RECORDS

  See you soon

  John
  http://John-Goodwin.blogspot.com/

• Audit trail - on tables

  Hello, I got where I got to watch the scenario changes which makes the user.
  
  It was easy for me to monitor on a regular basis. But when it comes in the form that the form doesn't have any associated point page... I had to use the trigger on the table.
  
  But on the use of the trigger on table, I noticed that the relaxation begins when you delete records from all the tables changing. COS even the Audit trail data in table are deleted right here. So is there a way I can monitor the removal of records from APEX part INSTEAD OF trigger on table tabular presentation.
  
  Thank you.

  So is there a way I can monitor the removal of records from APEX part INSTEAD OF trigger on table tabular presentation.

  I recommend you implement the verification on the side of the database, rather than on the side 'client' (Apex), as this would work regardless of the client (sqlplus, ODP.NET program, etc.) is used to update the data.

  Depending on your version of the database and the license, you can use the "Total Recall" feature, which manages in fact for you:

  http://www.Oracle.com/technetwork/issue-archive/2008/08-Jul/o48totalrecall-092147.html

  + "Oracle Total Recall provides many advantages over traditional archival methods based on demand and trigger.» First of all, archiving data are inviolable. No database user, not even privileged users, cannot change the historical record. This level of security is increasingly required by government regulation. No programming effort is necessary. There is no table archive design, no code to write and no trigger to debug. The result has much less risk than any which can damage inadvertently archive. The performance impact is minimal. There is no direct impact on the flow of transactions, because the processes involved in archiving run asynchronously. Oracle Total Recall is implemented natively in the Oracle database and application-transparent. You can implement it under a running application without making changes to existing code. » +

  Or you can use the trigger approach as you tried.

  But on the use of the trigger on table, I noticed that the relaxation begins when you delete records from all the tables changing. COS even the Audit trail data in table are deleted right here.

  This should not happen if you use a separate table to save the audit trail information in.

  For example, if you have the EMP table, you create a table named (for example) $ AUD EMP, which is identical in structure, except that it has additional columns to track audit date, user name and operation (insert, update, delete).

  Then you put a trigger "for each line" on EMP to save the changes to the AUD$ EMP. You can delete all you want from EMP, it does not table mutation error.

  -Morten

  http://ORA-00001.blogspot.com