audit "delete from" and logminer

From: Stephan Bressler <sbresslerx_no_spam_at_arcor.de>
Date: Tue, 03 Feb 2004 13:30:22 +0100
Message-ID: <bvo48d$5bk$1@news.mch.sbs.de>

Hi NG,
I'm on 9.2 on Solaris.
Our application sometimes deletes data from a table, which should not happen.
Therefor I
- setup auditing (audit delete on <table>)

made a copy of the tables primary key columns plus ROWID (CTAS)
kept the redo logs for usage with logminer.

No, today auditing tells me that a single record was deleted yesterday afternoon. A compare beween my saved_table and the production table shows no missing rows.
Logminer, on the other hand, shows me dozens of delete operations on the table.
According to logminer, session usually do a insert, 2 updates followed by a delete.

Why is there only one audit record? Where are all the delete rows (according to logminer) done? If I do a select with the data contained in sql_redo of the delete statement, I get a single row. Even the oracle rowid is correct.

Any ideas?

Stephan Received on Tue Feb 03 2004 - 06:30:22 CST