Re: trigger and LogMiner

Hi!

Maybe they were thinking that if you audit select statements, you can analyze inserts on AUD$ using logminer later on....

Anyway, if there's any future release where selects can be in redo, I hope they aren't there by default..

Tanel.

• Original Message ----- To: "Multiple recipients of list ORACLE-L" <[EMAIL PROTECTED]> Sent: Thursday, July 10, 2003 2:19 PM

> Hi Arup and Joe
>
> When I wrote the SANS Oracle security step-by-step book I wrote in there
> the list of restrictions for log miner including that is didn't support
> selects and during the review process of my book someone in Oracle who
> was reviewing it informed me that selects would be in the redo in one of
> the 9i releases, so i changed the book to say fixed in 9i.
>
> To be honest I now agree with you, it doesn't make sense for selects to
> be in the redo, although i suppose they could include them if they
> wanted to.
>
> At least for 9iR1 I am sure they are not included as I did some tests 2
> or 3 weeks ago when i was writing a paper "detecting SQL injection on
> Oracle" for securityfocus.com and selects were definitely not recorded
> by logminer. I did not also dump the archive log to trace to see if
> there was no select in it but at least LogMiner does not recognise
> selects. I copied the list i posted from a file yesterday without
> thinking i was perpetuating this issue even though i saw myself a few
> weeks ago it wasn't true.
>
> kind regards
>
> Pete
>
> In article <[EMAIL PROTECTED]>, Arup Nanda
> <[EMAIL PROTECTED]> writes
> >Hi Pete,
> >
> >I am a little prerplexed by "selects are not recorded in redo prior to 9i
".
> >AFAIK selects are nevere recorded in the redo, and therefore archived
logs -
> >so they are never unearthed by LogMiner, even in 9i Release2. Isn't that
> >true?
> >
> >Thanks.
> >
> >Arup
> --
> Pete Finnigan
> email:[EMAIL PROTECTED]
> Web site: http://www.petefinnigan.com - Oracle security audit specialists
> Book:Oracle security step-by-step Guide - see http://store.sans.org for
details.
>
> --
> Please see the official ORACLE-L FAQ: http://www.orafaq.net
> --
> Author: Pete Finnigan
> INET: [EMAIL PROTECTED]
>
> Fat City Network Services -- 858-538-5051 http://www.fatcity.com
> San Diego, California -- Mailing list and web hosting services
> ---------------------------------------------------------------------
> To REMOVE yourself from this mailing list, send an E-Mail message
> to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
> the message BODY, include a line containing: UNSUB ORACLE-L
> (or the name of mailing list you want to be removed from). You may
> also send the HELP command for other information (like subscribing).
>
>

-- 
Please see the official ORACLE-L FAQ: http://www.orafaq.net
-- 
Author: Tanel Poder
  INET: [EMAIL PROTECTED]

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from).  You may
also send the HELP command for other information (like subscribing).