RE: Logminer showing an update that could not have happened
- From: "Justin Cave (DDBC)" <jcave@xxxxxxxxxxx>
- To: "cshapi@xxxxxxxxx" <cshapi@xxxxxxxxx>, oracle-l <oracle-l@xxxxxxxxxxxxx>
- Date: Fri, 6 Nov 2009 21:20:23 -0700
What version of Oracle are you using? Any chance that you are being affected
by Bug 5458753 - SQL may execute in wrong schema (also discussed in Doc ID
392673.1)? That affects 10.2.0.2-- I thought it was resolved in 10.2.0.3.
Justin Cave
Distributed Database Consulting, Inc.
http://www.ddbcinc.com
-----Original Message-----
From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx] On
Behalf Of Chen Shapira
Sent: Friday, November 06, 2009 10:42 PM
To: oracle-l
Subject: Logminer showing an update that could not have happened
Dear Oracle Experts,
User A complained about unexplained changes in one of his tables.
Since he had an exact timestamp of when the data changed, I decided to
use logminer to look into it.
I filtered the logminer results to show me just the specific segment
that changed, so I filtered by seg_name="T1" and seg_owner="A".
Then I looked at username, session#, session info, sql_redo and sql_undo.
From the information in the log miner, it looked like user B updated
the table that belongs to user A.
(i.e. username is B, login_user inside session_info was user B,
machine in session_info was user B's desktop, and SQL Redo was "update
A.T1....")
The problem is that user B does not have the required privileges to do
this update. I double checked that by logging in as user B, tried to
run the exact update I was in the logminer table and received:
ORA-01031: insufficient privileges
Just like I expected from examining sys privs, object privs and roles.
One possibility is that the privileges were changed after the update
happened. I seriously doubt it, but currently its the only theory I
have.
Is there other possibilities? Can I be misreading the log miner table?
I'll appreciate any hints and directions.
Thanks,
Chen Shapira
--
//www.freelists.org/webpage/oracle-l
Internal Virus Database is out of date.
Checked by AVG - www.avg.com
Version: 8.5.422 / Virus Database: 270.14.21/2445 - Release Date: 10/19/09
06:40:00
--
//www.freelists.org/webpage/oracle-l
Other related posts:
