RE: Logminer showing an update that could not have happened

From: Justin Cave (DDBC) <"Justin>
Date: Fri, 6 Nov 2009 21:20:23 -0700
Message-ID: <394E9FCFBBED3C4D965D0EB84CC30B312FC500AEF8_at_EXCHANGE.ddbc.local>

What version of Oracle are you using? Any chance that you are being affected by Bug 5458753 - SQL may execute in wrong schema (also discussed in Doc ID 392673.1)? That affects I thought it was resolved in

Justin Cave
Distributed Database Consulting, Inc.

-----Original Message-----

From: [] On Behalf Of Chen Shapira Sent: Friday, November 06, 2009 10:42 PM To: oracle-l
Subject: Logminer showing an update that could not have happened

Dear Oracle Experts,

User A complained about unexplained changes in one of his tables. Since he had an exact timestamp of when the data changed, I decided to use logminer to look into it.

I filtered the logminer results to show me just the specific segment that changed, so I filtered by seg_name="T1" and seg_owner="A". Then I looked at username, session#, session info, sql_redo and sql_undo.

From the information in the log miner, it looked like user B updated the table that belongs to user A.
(i.e. username is B, login_user inside session_info was user B, machine in session_info was user B's desktop, and SQL Redo was "update A.T1....")

The problem is that user B does not have the required privileges to do this update. I double checked that by logging in as user B, tried to run the exact update I was in the logminer table and received: ORA-01031: insufficient privileges
Just like I expected from examining sys privs, object privs and roles.

One possibility is that the privileges were changed after the update happened. I seriously doubt it, but currently its the only theory I have.

Is there other possibilities? Can I be misreading the log miner table?

I'll appreciate any hints and directions.

Chen Shapira

Internal Virus Database is out of date.
Checked by AVG -
Version: 8.5.422 / Virus Database: 270.14.21/2445 - Release Date: 10/19/09 06:40:00
-- Received on Fri Nov 06 2009 - 22:20:23 CST

Original text of this message