Re: audit "delete from" and logminer

The SQL in logminer may not be the same as in the originating app, as it

    creates it on the fly based on the modified blocks.

So, a single delete statement that effects multiple rows will get turned into multiple statements in logminer, one for each record.

--Peter

Stephan Bressler wrote:
> Hi NG,
> I'm on 9.2 on Solaris.
> Our application sometimes deletes data from a table, which should not
> happen.
> Therefor I
> - setup auditing (audit delete on <table>)
> - made a copy of the tables primary key columns plus ROWID (CTAS)
> - kept the redo logs for usage with logminer.
>
> No, today auditing tells me that a single record was deleted yesterday
> afternoon. A compare beween my saved_table and the production table
> shows no missing rows.
> Logminer, on the other hand, shows me dozens of delete operations on the
> table.
> According to logminer, session usually do a insert, 2 updates followed
> by a delete.
>
> Why is there only one audit record? Where are all the delete rows
> (according to logminer) done? If I do a select with the data contained
> in sql_redo of the delete statement, I get a single row. Even the oracle
> rowid is correct.
>
> Any ideas?
>
> Stephan
>
>
Received on Tue Feb 03 2004 - 11:22:50 CST