Hi! Maybe they were thinking that if you audit select statements, you can analyze inserts on AUD$ using logminer later on....
Anyway, if there's any future release where selects can be in redo, I hope they aren't there by default.. Tanel. ----- Original Message ----- To: "Multiple recipients of list ORACLE-L" <[EMAIL PROTECTED]> Sent: Thursday, July 10, 2003 2:19 PM > Hi Arup and Joe > > When I wrote the SANS Oracle security step-by-step book I wrote in there > the list of restrictions for log miner including that is didn't support > selects and during the review process of my book someone in Oracle who > was reviewing it informed me that selects would be in the redo in one of > the 9i releases, so i changed the book to say fixed in 9i. > > To be honest I now agree with you, it doesn't make sense for selects to > be in the redo, although i suppose they could include them if they > wanted to. > > At least for 9iR1 I am sure they are not included as I did some tests 2 > or 3 weeks ago when i was writing a paper "detecting SQL injection on > Oracle" for securityfocus.com and selects were definitely not recorded > by logminer. I did not also dump the archive log to trace to see if > there was no select in it but at least LogMiner does not recognise > selects. I copied the list i posted from a file yesterday without > thinking i was perpetuating this issue even though i saw myself a few > weeks ago it wasn't true. > > kind regards > > Pete > > In article <[EMAIL PROTECTED]>, Arup Nanda > <[EMAIL PROTECTED]> writes > >Hi Pete, > > > >I am a little prerplexed by "selects are not recorded in redo prior to 9i ". > >AFAIK selects are nevere recorded in the redo, and therefore archived logs - > >so they are never unearthed by LogMiner, even in 9i Release2. Isn't that > >true? > > > >Thanks. > > > >Arup > -- > Pete Finnigan > email:[EMAIL PROTECTED] > Web site: http://www.petefinnigan.com - Oracle security audit specialists > Book:Oracle security step-by-step Guide - see http://store.sans.org for details. > > -- > Please see the official ORACLE-L FAQ: http://www.orafaq.net > -- > Author: Pete Finnigan > INET: [EMAIL PROTECTED] > > Fat City Network Services -- 858-538-5051 http://www.fatcity.com > San Diego, California -- Mailing list and web hosting services > --------------------------------------------------------------------- > To REMOVE yourself from this mailing list, send an E-Mail message > to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in > the message BODY, include a line containing: UNSUB ORACLE-L > (or the name of mailing list you want to be removed from). You may > also send the HELP command for other information (like subscribing). > > -- Please see the official ORACLE-L FAQ: http://www.orafaq.net -- Author: Tanel Poder INET: [EMAIL PROTECTED] Fat City Network Services -- 858-538-5051 http://www.fatcity.com San Diego, California -- Mailing list and web hosting services --------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).
