Re: [logs] oracle logminer

Previous message: Darren Reed: "Re: [logs] SDSC Secure Syslog"
In reply to: Justin H Tran: "[logs] oracle logminer"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

peteat_private

Hi Justin

I have briefly used it on Oracle 8.1.7, it has some serious deficiencies
in Oracle 8. It is not possible to extract select statements from redo
logs until Oracle 9i, all DML that cause changes can of course be
extracted. It is difficult to extract the exact original SQL and there
are problems with migrated and chained rows. Also I believe if MTS is
used logminer cannot be used. It is still possible to dump the redo logs
to trace and interpret the trace file of course!!. 

Using redo logs for forensics work can be useful especially if no audit
has been turned on and unlike audit redo is always (not 100% true) on
and doesn't incur overhead.

have you used it yourself?

kind regards

Pete

>
>has anyone on this group use Oracle Logminer?  I am looking for pros/cons,
>etc...
-- 
Pete Finnigan

peteat_private
peteat_private

http://www.petefinnigan.com

http://online.securityfocus.com/infocus/1644 - "SQL injection and Oracle - part 
one"

http://online.securityfocus.com/infocus/1646 - "SQL injection and Oracle - part 
one"

http://online.securityfocus.com/infocus/1522 - "A simple Oracle Security
Scanner"

http://downloads.securityfocus.com/library/oracle-security.pdf - "Exploiting and 
protecting Oracle"

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis