BusinessObjects Board

WebI and Auditing

Is the Auditor tool, that is sold separately, based on obj_a_event_log and obj_a_event_detl tables?

Is it me or does anyone else think that there is a poor table design and inconsistent data that gets stored in them? It makes me worry how buggy the Auditor tool might be.

We’ll probably stick with the audit.unv that comes with BusObj CD, make our own modifications to the audit.unv and build our own reports if Auditor tool is based on these same tables.


Bill Fox (BOB member since 2002-07-10)

Hi!
Has anyone had any success in auditing ZABO ad-hoc queries and getting useful information? Either object names/conditions/universe or SQL would do. If so, which version of WEBI/ZABO are you using?

Thanks,

Ann.


Rummers :uk: (BOB member since 2002-09-02)

I’m not sure. I do know that Auditor uses a bunch of tables that are specific to Auditor and not to the default auditing tables that WebI uses.


Steve Krandel :us: (BOB member since 2002-06-25)

I’ll take a look tomorrow Ann. Our interest has been on which corporate documents are being refreshed and timings so I haven’t really looked at ad-hoc at all. I’ll play around with it a bit and let you know what I’m seeing.

Have you been able to get any timings on Zabo report runs. Mine, as I said earlier in this thread, all show up as ‘1’. I also get a bogus set of refresh records representing the rows stored with the report for the last report run. Right now I’m only using the Zabo info to tell me that a report was used. I’m getting all the timings and frequency info from Webi refreshes. Fortunately, most of our users are webi anyway.


Cindy Clayton :us: (BOB member since 2002-06-11)

Auditor primarily uses views, but those views are based on the standard audit tables. There aren’t any “new” tables created specifically for the Auditor package that I am aware of.

Auditor is essentially a “pretty” front-end, using four different universes, and a number of pre-built full-client reports that are displayed via a JSP interface.

Three of the four universes are based on the regular repository tables, and they run into the same issues the rest of us run into when trying to create reports against the repository. In other words, they can’t answer the questions we want to answer either. :wink: The fourth universe has at its core the audit tables, but translated through views. By using views, they can distribute the same universe for all platforms, as all of the database abstraction stuff (like case vs. decode vs whatever) is contained in the view logic. So that’s a good thing.

But many of their reports are misleading or inaccurate. For example, they have an “impact analysis” report that is not very useful. It will only analyze documents that have been refreshed at least once. Their concurrent user report shows users that log in at “popular” times, but makes no effort to show how long that user was logged in. In other words, a person that logs in, checks personal documents, and logs out for a total session duration of 5 minutes counts just as much as a person that logs in and stays logged in for four hours.

The object-level reports are limited to webi reports, no object-level detail is available for full client reports.

The do make use of the ability to do multiple data provider reports to solve questions like “Which users have never logged in” and “Which documents have never been accessed”, but those questions are only as good as the amount of audit data that you have (time frame, in other words).

If you’re happy with the freeware audit.unv, then you’ll be fine without purchasing the auditor product, in my opinion. If you don’t want to develop the universes and reports on your own, then it’s worth taking a look at.

Be advised, however, that the concept of “server license” is a bit odd when talking about Auditor. It’s not how many servers you want to run the Auditor package on, it’s how many servers you want to Audit. :slight_smile:

Dave


Dave Rathbun :us: (BOB member since 2002-06-06)

I do see universe names on zabo ad-hoc queries. We’re 2.6.3/5.1.3. The event is #13, Selection of Universe. That’s ALL I see.

I also see the universe when I run a document I have locally. That shows up when I refresh #19 as trace type ‘Universe Name’. I refreshed the same doc a second time and I get the usual three #19’s for the additional refresh but blank trace type data. Perhaps my logs haven’t completely flushed yet. I’ve had trouble with that as well . If the auditor product has no more data to work with than we do, I fail to see exactly what it offers that I can’t do for myself at a lot less expense. I’m probably just uninformed. I’m sure someone will set me straight post haste!


Cindy Clayton :us: (BOB member since 2002-06-11)

Hi I have to agree with all the things said so far on this thread so far.

I guess I am as unifomred as anbody else
but as far as we know BO auditor runs of the Webi audit tables (and all the known issues with it, reset of id at reboot, …).

As far as I know Cindy and Dave get it right when they say: " it is a pretty front end to the Webi audit tables at a certain price".

The other part is all the reporting on the reposiotry but I assume that most people have already universes on that anyway (at leas our customers have)

If you need more details the only way is to caputre more and this is reason we built our product.


ClaireB :de: (BOB member since 2002-08-09)

Thanks Cindy,
I will do a bit more investigating on what I get from our tables & see if there is any more useful information that can be gained. However, from what everyone has said so far, the auditor product itself does not look to be particularly useful, and won’t meet the requirements we have here. Especially as it is on a per server audited basis.

Ann.


Rummers :uk: (BOB member since 2002-09-02)

Will the “impact analysis” report work if the reports have been refreshed once since they have been published? or once since “Audit to the Database” has been turned on? or once since Auditor was installed?


Karen Burton :us: (BOB member since 2002-08-22)

Did any body has succesfully logged audit data into a oracle repository. I have created audit tables in the same database as the repository. Now when I am cheking the tables only OBJ_A_EVENT_DETL table is getting populated whereas OBJ_A_EVENT_LOG table is not getting poppulated.

Any solution or any ideas.


JaiGupta (BOB member since 2002-09-12)

I’ve gotten it turned on and all is working well. Did you create the tables or did you let them get created automatically when you turned it on? What modules do you have set for user activity audit?


Cindy Clayton :us: (BOB member since 2002-06-11)

I let BO to create the tables in the Business Objects repository. From the View log button I simply said log to database and chose the repository connetcion.

Do you use oracle repository.

Tables OBJ_A_SITE_LOG and OBJ_A_EVENT_LOG are not populated where as OBJ_A_EVENT_DETL is getting populated. Any ideas why?

Can you send me th scripts of your tables in the database.

I feel due to some insert error in the table it is not getting loaded. Any ideas how to trap that error.


JaiGupta (BOB member since 2002-09-12)

Yes Oracle :yesnod:

Hmmmm. Nope. I’ve occasionally had problems with detl not getting populated but it was always a space issue and my DBA gave me more room. More rows go into detl than event_log or site_log.


CREATE TABLE OBJ_A_EVENT_LOG ( 
  A_EVLOG_N_ID        NUMBER (10)   NOT NULL, 
  A_EVLOG_N_TYPEID    NUMBER (10)   NOT NULL, 
  A_EVLOG_D_STARTIME  DATE          NOT NULL, 
  A_EVLOG_N_DURATION  NUMBER (10)   NOT NULL, 
  A_EVLOG_C_USER      VARCHAR2 (35)  NOT NULL, 
  A_EVLOG_C_SESSION   VARCHAR2 (35)  NOT NULL, 
  A_EVLOG_N_APPID     NUMBER (10)   NOT NULL, 
  A_EVLOG_N_ERRORID   NUMBER (10)   NOT NULL, 
  A_EVLOG_C_HOST      VARCHAR2 (254)  NOT NULL)
   TABLESPACE WHEREVER NOLOGGING 
   PCTFREE 10
   PCTUSED 40
   INITRANS 1
   MAXTRANS 255
  STORAGE ( 
   INITIAL 4096
   NEXT 1536000
   MINEXTENTS 1
   MAXEXTENTS 20
   FREELISTS 1 FREELIST GROUPS 1 )
   NOCACHE; 


CREATE INDEX OBJ_A_EVENT_LOG_N1 ON 
  OBJ_A_EVENT_LOG(A_EVLOG_N_APPID) 
  TABLESPACE WHATEVER_IDX PCTFREE 10  STORAGE(INITIAL 5242880 NEXT 524288 PCTINCREASE 0 ) 
; 

CREATE INDEX OBJ_A_EVENT_LOG_N2 ON 
  OBJ_A_EVENT_LOG(A_EVLOG_N_TYPEID) 
  TABLESPACE WHATEVER_IDX PCTFREE 10  STORAGE(INITIAL 5242880 NEXT 524288 PCTINCREASE 0 ) 
; 


Did you check to see which modules are enabled for user activity auditing?

I’d generate some rows while my dba was watching to see what happened. HTH!


Cindy Clayton :us: (BOB member since 2002-06-11)

Did you changed your oracle sbo file.?
What is your default date format on oracle side(NLS_date format or something else ) and in the sbo file.

Data is there in the text files but it deos not go to the database. I feel it is a data issue(Session datatime).


JaiGupta (BOB member since 2002-09-12)

Where is Audit.unv located in Business Onjects 6.1 CD’s ?

In the past it used to come in Freeware directory.


Gul (BOB member since 2002-09-03)

You could try the one we have here in the Bob’s Downloads area. I also provided some reports to go along with it.


Cindy Clayton :us: (BOB member since 2002-06-11)

In Bo 6.1 some new audit tables are added. I am looking for the new Audit.unv which comes free with business objects. Does anybody has seen it on the CD or BO has stooped providing it.


Gul (BOB member since 2002-09-03)

Is the data stored in the WebI log files comma or tab delimited?


Andreas :de: (BOB member since 2002-06-20)

No clue. I write it straight to the DB. Anita probably knows. They write to log files I think. Why wouldn’t you wanna go that route? You can put in anywhere. Doesn’t have to be in the repo schema if that breaks a ‘don’t muck with Production’ rule.


Cindy Clayton :us: (BOB member since 2002-06-11)

OK, I found out that the WebI log files are stored as Tab delimited files.


Andreas :de: (BOB member since 2002-06-20)