Re: trigger and LogMiner

Idea for testing: looking for redo associated with select statement(s) that are cleaning out row level locks in block(s) from previously committed DML transaction(s).

Have Fun :)

Tanel Poder wrote:

>Hi!
>
>Maybe they were thinking that if you audit select statements, you can
>analyze inserts on AUD$ using logminer later on....
>
>Anyway, if there's any future release where selects can be in redo, I hope
>they aren't there by default..
>
>Tanel.
>
>----- Original Message -----
>To: "Multiple recipients of list ORACLE-L" <ORACLE-L_at_fatcity.com>
>Sent: Thursday, July 10, 2003 2:19 PM
>
>
>
>
>>Hi Arup and Joe
>>
>>When I wrote the SANS Oracle security step-by-step book I wrote in there
>>the list of restrictions for log miner including that is didn't support
>>selects and during the review process of my book someone in Oracle who
>>was reviewing it informed me that selects would be in the redo in one of
>>the 9i releases, so i changed the book to say fixed in 9i.
>>
>>To be honest I now agree with you, it doesn't make sense for selects to
>>be in the redo, although i suppose they could include them if they
>>wanted to.
>>
>>At least for 9iR1 I am sure they are not included as I did some tests 2
>>or 3 weeks ago when i was writing a paper "detecting SQL injection on
>>Oracle" for securityfocus.com and selects were definitely not recorded
>>by logminer. I did not also dump the archive log to trace to see if
>>there was no select in it but at least LogMiner does not recognise
>>selects. I copied the list i posted from a file yesterday without
>>thinking i was perpetuating this issue even though i saw myself a few
>>weeks ago it wasn't true.
>>
>>kind regards
>>
>>Pete
>>
>>In article <F001.005C413D.20030709081431_at_fatcity.com>, Arup Nanda
>><orarup_at_hotmail.com> writes
>>
>>
>>>Hi Pete,
>>>
>>>I am a little prerplexed by "selects are not recorded in redo prior to 9i
>>>
>>>
>".
>
>
>>>AFAIK selects are nevere recorded in the redo, and therefore archived
>>>
>>>
>logs -
>
>
>>>so they are never unearthed by LogMiner, even in 9i Release2. Isn't that
>>>true?
>>>
>>>Thanks.
>>>
>>>Arup
>>>
>>>
>>--
>>Pete Finnigan
>>email:pete_at_petefinnigan.com
>>Web site: http://www.petefinnigan.com - Oracle security audit specialists
>>Book:Oracle security step-by-step Guide - see http://store.sans.org for
>>
>>
>details.
>
>
>>--
>>Please see the official ORACLE-L FAQ: http://www.orafaq.net
>>--
>>Author: Pete Finnigan
>> INET: oracle_list_at_peterfinnigan.demon.co.uk
>>
>>Fat City Network Services -- 858-538-5051 http://www.fatcity.com
>>San Diego, California -- Mailing list and web hosting services
>>---------------------------------------------------------------------
>>To REMOVE yourself from this mailing list, send an E-Mail message
>>to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
>>the message BODY, include a line containing: UNSUB ORACLE-L
>>(or the name of mailing list you want to be removed from). You may
>>also send the HELP command for other information (like subscribing).
>>
>>
>>
>>
>
>
>
>

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: Chip
  INET: ocp-dba_at_earthlink.net

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).