logminer

[alberto.moreno]

Hi everyone:

It is possible to modify redolog or archivelog files with logminer or other tool ??

I've recovered a database and i can`t see in the archivelog files an insert that it has to be there. I'm not an expert in Oracle and i want to know if it is possible that someone can modify the archivelog files and now i can`t see the insert that people say that they made.


Thanks a lot

[Thomasps]

They might made the insert to some other database..! Do you got a DBA?

[alberto.moreno]

I´m the DBA (new). I just need to know if it is possible to modify the output of logminer with some tool.

Thanks a lot for your reply.

[Thomasps]

logminer cannot not do this... If you want to issue INSERT / UPDATE go to sqlplus and do it.

[alberto.moreno]

sorry i think that i'm not making the question so good.

The problem is that i'm looking inside archivelogs and i can't found some inserts that i expect that it has to be there. It is possible that someone can change the output of logminer???


Sorry for my english and thanks a lot

[Thomasps]

You have enough English to read Oracle Documents, so please read it!

Nobody can change the Redo log / archive log entries. Redo log will capture all transactions to the database ( few exceptions like NOLOGGING) with out fail. Read the document and Save your shop.

http://download-uk.oracle.com/docs/c...b14220/toc.htm
is the best place to start!

[DaPi]

I think there's more to this question.

a) can the redo/achlogs be modifed by spurious activity from a connected Oracle client? - NO.

b) can the redo/archlogs be modifed by some editor? - YES, they are just files after all. Access to these files should be limited by OS security to admins only (and I suspect that online redo can't be modified in Windows while the DB is up - OS file locking).

c) will logminer detect that an external change has been made to a log? - I don't know. I would hope so (missing SCN's?) - I suspect you'd have to be bloody clever to fool it.


As for the question of changes made NOLOGGING - can someone remind me how that's recorded in the data dictionary? If changes had been made nologging, you would have had problems doing the recovery.

[jhmartin]

Someone would have to go to a fair amount of effort to muck with the archivelogs in such a way that the DB could apply them yet omit a given transaction.

NOLOGGING changes will result in index mainteneance and space allocation mainteneance redo, but the data itself will not be logged. However only /*+APPEND*/ inserts truly honor nologging, there are many cases where you can specify it to no effect.

[pando]

i can`t see the insert that people say that they made.

Tell your boss that your users are lieing.

Oracle 11.5.10 Projects huh

[DaPi]

Tell your boss that your users are lieing.

Ockham's razor - this is the most likely explanation.