• Like
Log mining in Oracle Database
Upcoming SlideShare
Loading in...5

Thanks for flagging this SlideShare!

Oops! An error has occurred.

Log mining in Oracle Database


Log mining in Oracle Database

Log mining in Oracle Database

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
No Downloads


Total Views
On SlideShare
From Embeds
Number of Embeds



Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

    No notes for slide


  • 1. LOG MINING INORACLE DATABASE (Dated : January 12, 2012) Written By: Ahmer Mansoor Email : ahmer_mansoor@hotmail.comProfile : http://www.linkedin.com/in/ahmermansoor
  • 2. Written By: Ahmer MansoorEmail : ahmer_mansoor@hotmail.comProfile : http://www.linkedin.com/in/ahmermansoorSCENARIO Suppose data in a table has been deleted. Audit trail was not enabled, therefore we do not have a clueof the user who has performed deletion and there are around 30 users that have DELETE rights on that table. My Manager want to know the name of the user, therefore I have to use Oracle LOG MINING feature tofilter out the transactions performed during that period.Note: Make sure the Archive log must be enabled previously, if you want to use LOG Mining technique.CONSIDERATIONS Database : ORCL Schema : AHMER Table : STUDENTS Date of Deletion : 12-JAN-2011 Page | 2
  • 3. Written By: Ahmer MansoorEmail : ahmer_mansoor@hotmail.comProfile : http://www.linkedin.com/in/ahmermansoor1) Gather Archived Log Make archived logs of 12-JAN-2011 available in your local hard disk. In my case it is already available at the Flash Recovery Area, and I am directly working on the SERVER machine.2) Create Tablespace for Log Miner By default LOG MINER tables resides in SYSAUX tablespace, but it is efficient to keep it in a separatetablespace for easy manageability & maintenance. SQLPLUS SYS@ORCL AS SYSDBA CREATE TABLESPACE TS_LOGMNR DATAFILE C:ORACLEPRODUCT10.2.0ORADATAORCLTS_LOGMNR_01.DBF SIZE 25M AUTOEXTEND ON MAXSIZE UNLIMITED; Use the following statement to move all of LOG MINER objects from SYSAUX to TS_LOGMNR tablespace. EXEC DBMS_LOGMNR_D.SET_TABLESPACE(TS_LOGMNR);3) Start Log Mining Load Archive log file into Log Miner. BEGIN DBMS_LOGMNR.ADD_LOGFILE(C:ORACLEPRODUCT10.2.0FLASH_RECOVERY_AREAORCLA RCHIVELOG2012_01_12O1_MF_1_2_7JY3ZNWV_.ARC, DBMS_LOGMNR.NEW); END; / Perform Log Mining (Considering that the Log mining is performed on the same database, AlthoughArchive log of one database can be log mined into another database but the procedure would be different). BEGIN DBMS_LOGMNR.START_LOGMNR(OPTIONS=>DBMS_LOGMNR.DICT_FROM_ONLINE_CATALOG+ DBMS_LOGMNR.COMMITTED_DATA_ONLY); END; / Page | 3
  • 4. Written By: Ahmer MansoorEmail : ahmer_mansoor@hotmail.comProfile : http://www.linkedin.com/in/ahmermansoor Format query results. SET TRIM ON SET LINES 200 COL USERNAME FORMAT A15 COL TIMESTAMP FORMAT A20 COL SESSION_INFO FORMAT A200 Spool the output to a text file. SPOOL C:LOGMNR.TXT SELECT USERNAME, TO_CHAR(TIMESTAMP,’DD-MON-YYYYY HH24:MI:SS’) TIMESTAMP, SESSION_INFO, SQL_REDO, SQL_UNDO FROM V$LOGMNR_CONTENTS WHERE SEG_OWNER=’AHMER’ AND SEG_NAME=’STUDENTS’ AND OPERATION=’DELETE’; SPOOL OFF Stop Log Miner. BEGIN DBMS_LOGMNR.END_LOGMNR; END; / Open C:LOGMNR.TXT and look for DELETE statements. If you do not locate the problematic query,repeat the step 2 (above) with another archive log file, and keep repeating it until you caught the query and theuser that has performed the DELETE operation.Note: V$LOGMNR_CONTENTS has many columns, and you can customize your results by modifying the abovequery. Page | 4