Log Miner

Oracle Database Administration

Learn Oracle 10g database administration
step by step
 

Oracle DBA Interview Questions

Frequently asked Oracle DBA Interview
Questions
 

Download Oracle 10g Software

Links for downloading Oracle 10g software
Installation guides for installing Oracle under
Linux, Solaris
 

Using Log Miner utility, you can query the contents of online redo log files and archived log
files. Because LogMiner provides a well-defined, easy-to-use, and comprehensive relational
interface to redo log files, it can be used as a powerful data audit tool, as well as a tool for
sophisticated data analysis.

LogMiner Configuration

There are three basic objects in a LogMiner configuration that you should be familiar with:
the source database,  the LogMiner dictionary, and the redo log files containing the data of
interest:

 The source database is the database that produces all the redo log files that you want
LogMiner to analyze.
 The LogMiner dictionary allows LogMiner to provide table and column names,
instead of internal object IDs, when it presents the redo log data that you request.
LogMiner uses the dictionary to translate internal object identifiers and datatypes to object
names and external data formats. Without a dictionary, LogMiner returns internal object IDs
and presents data as binary data.

For example, consider the following the SQL statement:

INSERT INTO HR.JOBS(JOB_ID, JOB_TITLE, MIN_SALARY,

MAX_SALARY)  VALUES('IT_WT','Technical Writer', 4000, 11000);

Without the dictionary, LogMiner will display:

insert into "UNKNOWN"."OBJ# 45522"("COL 1","COL 2","COL 3","COL 4") values

(HEXTORAW('45465f4748'),HEXTORAW('546563686e6963616c20577269746572'),

HEXTORAW('c229'),HEXTORAW('c3020b'));

                The redo log files contain the changes made to the database or database dictionary.

LogMiner Dictionary Options

LogMiner requires a dictionary to translate object IDs into object names when it returns redo
data to you. LogMiner gives you three options for supplying the dictionary:

 Using the Online Catalog

Oracle recommends that you use this option when you will have access to the source database
from which the redo log files were created and when no changes to the column definitions in
the tables of interest are anticipated. This is the most efficient and easy-to-use option.

 Extracting a LogMiner Dictionary to the Redo Log Files

Oracle recommends that you use this option when you do not expect to have access to the
source database from which the redo log files were created, or if you anticipate that changes
will be made to the column definitions in the tables of interest.

 Extracting the LogMiner Dictionary to a Flat File

This option is maintained for backward compatibility with previous releases. This option
does not guarantee transactional consistency. Oracle recommends that you use either the
online catalog or extract the dictionary from redo log files instead.

Using the Online Catalog

To direct LogMiner to use the dictionary currently in use for the database, specify the online
catalog as your dictionary source when you start LogMiner, as follows:

SQL> EXECUTE DBMS_LOGMNR.START_LOGMNR(-

       OPTIONS => DBMS_LOGMNR.DICT_FROM_ONLINE_CATALOG);

Extracting a LogMiner Dictionary to the Redo Log Files

To extract a LogMiner dictionary to the redo log files, the database must be open and in
ARCHIVELOG mode and archiving must be enabled. While the dictionary is being extracted
to the redo log stream, no DDL statements can be executed. Therefore, the dictionary
extracted to the redo log files is guaranteed to be consistent (whereas the dictionary extracted
to a flat file is not).

To extract dictionary information to the redo log files, use the DBMS_LOGMNR_D.BUILD
procedure with the STORE_IN_REDO_LOGS option. Do not specify a filename or location.

SQL> EXECUTE DBMS_LOGMNR_D.BUILD(OPTIONS=>

DBMS_LOGMNR_D.STORE_IN_REDO_LOGS);

Extracting the LogMiner Dictionary to a Flat File

When the LogMiner dictionary is in a flat file, fewer system resources are used than when it
is contained in the redo log files. Oracle recommends that you regularly back up the
dictionary extract to ensure correct analysis of older redo log files.

1. Set the initialization parameter, UTL_FILE_DIR, in the initialization parameter file. For
example, to set UTL_FILE_DIR to use /oracle/database as the directory where the
dictionary file is placed, enter the following in the initialization parameter file:

UTL_FILE_DIR = /oracle/database

2. Start the Database

SQL> startup

3. Execute the PL/SQL procedure DBMS_LOGMNR_D.BUILD. Specify a filename for

the dictionary and a directory path name for the file. This procedure creates the
dictionary file. For example, enter the following to create the file
dictionary.ora in /oracle/database:

SQL> EXECUTE DBMS_LOGMNR_D.BUILD('dictionary.ora','/oracle/database/',

                       DBMS_LOGMNR_D.STORE_IN_FLAT_FILE);

Redo Log File Options

To mine data in the redo log files, LogMiner needs information about which redo log files to
mine.

You can direct LogMiner to automatically and dynamically create a list of redo log files to
analyze, or you can explicitly specify a list of redo log files for LogMiner to analyze, as
follows:

Automatically

If LogMiner is being used on the source database, then you can direct LogMiner to find and
create a list of redo log files for analysis automatically. Use the CONTINUOUS_MINE option
when you start LogMiner.

Manually

Use the DBMS_LOGMNR.ADD_LOGFILE procedure to manually create a list of redo log

files before you start LogMiner. After the first redo log file has been added to the list, each
subsequently added redo log file must be from the same database and associated with the
same database RESETLOGS SCN. When using this method, LogMiner need not be
connected to the source database.

Example: Finding All Modifications in the Current Redo Log File

The easiest way to examine the modification history of a database is to mine at the source
database and use the online catalog to translate the redo log files. This example shows how to
do the simplest analysis using LogMiner.

Step 1 Specify the list of redo log files to be analyzed.

Specify the redo log files which you want to analyze.

SQL> EXECUTE DBMS_LOGMNR.ADD_LOGFILE( -

       LOGFILENAME => '/usr/oracle/ica/log1.ora',

       OPTIONS => DBMS_LOGMNR.NEW);

SQL> EXECUTE DBMS_LOGMNR.ADD_LOGFILE( -

       LOGFILENAME => '/u01/oracle/ica/log2.ora',

       OPTIONS => DBMS_LOGMNR.ADDFILE);

Step 2 Start LogMiner.

Start LogMiner and specify the dictionary to use.

SQL> EXECUTE DBMS_LOGMNR.START_LOGMNR(

       OPTIONS => DBMS_LOGMNR.DICT_FROM_ONLINE_CATALOG);

Step 3 Query the V$LOGMNR_CONTENTS view.

Note that there are four transactions (two of them were committed within the redo log file
being analyzed, and two were not). The output shows the DML statements in the order in
which they were executed; thus transactions interleave among themselves.

SQL> SELECT username AS USR, (XIDUSN || '.' || XIDSLT || '.' ||  XIDSQN) AS
XID,SQL_REDO, SQL_UNDO FROM V$LOGMNR_CONTENTS WHERE username IN ('HR',
'OE');

USR    XID          SQL_REDO                        SQL_UNDO

----   ---------  ----------------------------------------------------
HR     1.11.1476  set transaction read write;
 
HR     1.11.1476  insert into "HR"."EMPLOYEES"(     delete from "HR"."EMPLOYEES"
                  "EMPLOYEE_ID","FIRST_NAME",       where "EMPLOYEE_ID" = '306'
                  "LAST_NAME","EMAIL",              and "FIRST_NAME" = 'Mohammed'
                  "PHONE_NUMBER","HIRE_DATE",       and "LAST_NAME" = 'Sami'
                  "JOB_ID","SALARY",                and "EMAIL" = 'MDSAMI'
                  "COMMISSION_PCT","MANAGER_ID",    and "PHONE_NUMBER" = '1234567890'
                  "DEPARTMENT_ID") values           and "HIRE_DATE" = TO_DATE('10-JAN-2003
                  ('306','Mohammed','Sami',         13:34:43', 'dd-mon-yyyy hh24:mi:ss')
                  'MDSAMI', '1234567890',           and "JOB_ID" = 'HR_REP' and
                  TO_DATE('10-jan-2003 13:34:43',   "SALARY" = '120000' and
                  'dd-mon-yyyy hh24:mi:ss'),         "COMMISSION_PCT" = '.05' and
                  'HR_REP','120000', '.05',         "DEPARTMENT_ID" = '10' and
                  '105','10');                      ROWID = 'AAAHSkAABAAAY6rAAO';
    
OE     1.1.1484   set transaction read write;
 
OE     1.1.1484   update "OE"."PRODUCT_INFORMATION"  update "OE"."PRODUCT_INFORMATION"
                  set "WARRANTY_PERIOD" =            set "WARRANTY_PERIOD" =
                  TO_YMINTERVAL('+05-00') where      TO_YMINTERVAL('+01-00') where
                  "PRODUCT_ID" = '1799' and          "PRODUCT_ID" = '1799' and
                  "WARRANTY_PERIOD" =                "WARRANTY_PERIOD" =
                  TO_YMINTERVAL('+01-00') and        TO_YMINTERVAL('+05-00') and
                  ROWID = 'AAAHTKAABAAAY9mAAB';      ROWID = 'AAAHTKAABAAAY9mAAB';
                                                                               
OE     1.1.1484   update "OE"."PRODUCT_INFORMATION"  update "OE"."PRODUCT_INFORMATION"
                  set "WARRANTY_PERIOD" =            set "WARRANTY_PERIOD" =
                  TO_YMINTERVAL('+05-00') where      TO_YMINTERVAL('+01-00') where
                  "PRODUCT_ID" = '1801' and          "PRODUCT_ID" = '1801' and
                  "WARRANTY_PERIOD" =                "WARRANTY_PERIOD" =
                  TO_YMINTERVAL('+01-00') and        TO_YMINTERVAL('+05-00') and
                  ROWID = 'AAAHTKAABAAAY9mAAC';      ROWID ='AAAHTKAABAAAY9mAAC';
 
HR     1.11.1476  insert into "HR"."EMPLOYEES"(     delete from "HR"."EMPLOYEES"
                  "EMPLOYEE_ID","FIRST_NAME",       "EMPLOYEE_ID" = '307' and
                  "LAST_NAME","EMAIL",              "FIRST_NAME" = 'John' and
                  "PHONE_NUMBER","HIRE_DATE",       "LAST_NAME" = 'Silver' and
                  "JOB_ID","SALARY",                "EMAIL" = 'JSILVER' and
                  "COMMISSION_PCT","MANAGER_ID",    "PHONE_NUMBER" = '5551112222'
                  "DEPARTMENT_ID") values           and "HIRE_DATE" = TO_DATE('10-
jan-                                                    2003
                  ('307','John','Silver',           13:41:03', 'dd-mon-yyyy hh24:mi:ss')
                   'JSILVER', '5551112222',         and "JOB_ID" ='105' and
                                                    "DEPARTMENT_ID"
                  TO_DATE('10-jan-2003 13:41:03',   = '50' and ROWID =
                                                    'AAAHSkAABAAAY6rAAP';
                  'dd-mon-yyyy hh24:mi:ss'),
                  'SH_CLERK','110000', '.05',
                  '105','50');               
 
OE     1.1.1484   commit;
 
HR     1.15.1481   set transaction read write;
 
HR     1.15.1481  delete from "HR"."EMPLOYEES"      insert into "HR"."EMPLOYEES"(
                  where "EMPLOYEE_ID" = '205' and   "EMPLOYEE_ID","FIRST_NAME",
                  "FIRST_NAME" = 'Shelley' and      "LAST_NAME","EMAIL","PHONE_NUMBER",
                  "LAST_NAME" = 'Higgins' and       "HIRE_DATE", "JOB_ID","SALARY",
                  "EMAIL" = 'SHIGGINS' and          "COMMISSION_PCT","MANAGER_ID",
                  "PHONE_NUMBER" = '515.123.8080'   "DEPARTMENT_ID") values
                  and "HIRE_DATE" = TO_DATE(        ('205','Shelley','Higgins',
                  '07-jun-1994 10:05:01',           and     'SHIGGINS','515.123.8080',
                  'dd-mon-yyyy hh24:mi:ss')         TO_DATE('07-jun-1994 10:05:01',
                  and "JOB_ID" = 'AC_MGR'           'dd-mon-yyyy hh24:mi:ss'),
                  and "SALARY"= '12000'            'AC_MGR','12000',NULL,'101','110');
                  and "COMMISSION_PCT" IS NULL
                  and "MANAGER_ID"
                  = '101' and "DEPARTMENT_ID" =
                  '110' and ROWID =
                  'AAAHSkAABAAAY6rAAM';
 
 
OE     1.8.1484   set transaction read write;
 
OE     1.8.1484   update "OE"."PRODUCT_INFORMATION"  update "OE"."PRODUCT_INFORMATION"
                  set "WARRANTY_PERIOD" =            set "WARRANTY_PERIOD" =
                  TO_YMINTERVAL('+12-06') where      TO_YMINTERVAL('+20-00') where
                  "PRODUCT_ID" = '2350' and          "PRODUCT_ID" = '2350' and
                  "WARRANTY_PERIOD" =                "WARRANTY_PERIOD" =
                  TO_YMINTERVAL('+20-00') and        TO_YMINTERVAL('+20-00') and
                  ROWID = 'AAAHTKAABAAAY9tAAD';       ROWID ='AAAHTKAABAAAY9tAAD';
 
HR     1.11.1476  commit;

Step 4 End the LogMiner session.

SQL> EXECUTE DBMS_LOGMNR.END_LOGMNR();

Example of Mining Without Specifying the List of Redo Log Files Explicitly

The previous example explicitly specified the redo log file or files to be mined. However, if
you are mining in the same database that generated the redo log files, then you can mine the
appropriate list of redo log files by just specifying the time (or SCN) range of interest. To
mine a set of redo log files without explicitly specifying them, use the
DBMS_LOGMNR.CONTINUOUS_MINE option to the DBMS_LOGMNR.START_LOGMNR
procedure, and specify either a time range or an SCN range of interest.

Example : Mining Redo Log Files in a Given Time Range

This example assumes that you want to use the data dictionary extracted to the redo log files.

Step 1 Determine the timestamp of the redo log file that contains the start of the data
dictionary.

SQL> SELECT NAME, FIRST_TIME FROM V$ARCHIVED_LOG

WHERE SEQUENCE# = (SELECT MAX(SEQUENCE#) FROM V$ARCHIVED_LOG

       WHERE DICTIONARY_BEGIN = 'YES');

NAME                                          FIRST_TIME
--------------------------------------------  --------------------

/usr/oracle/data/db1arch_1_207_482701534.dbf  10-jan-2003 12:01:34

Step 2 Display all the redo log files that have been generated so far.

This step is not required, but is included to demonstrate that the CONTINUOUS_MINE option
works as expected, as will be shown in Step 4.

SQL> SELECT FILENAME name FROM V$LOGMNR_LOGS

       WHERE LOW_TIME > '10-jan-2003 12:01:34';

NAME

----------------------------------------------

/usr/oracle/data/db1arch_1_207_482701534.dbf

/usr/oracle/data/db1arch_1_208_482701534.dbf

/usr/oracle/data/db1arch_1_209_482701534.dbf

/usr/oracle/data/db1arch_1_210_482701534.dbf

Step 3 Start LogMiner.

Start LogMiner by specifying the dictionary to use and the COMMITTED_DATA_ONLY,

PRINT_PRETTY_SQL, and CONTINUOUS_MINE options.

SQL> EXECUTE DBMS_LOGMNR.START_LOGMNR(-

       STARTTIME => '10-jan-2003 12:01:34', -

         ENDTIME => SYSDATE, -

                OPTIONS => DBMS_LOGMNR.DICT_FROM_REDO_LOGS + -

                    DBMS_LOGMNR.COMMITTED_DATA_ONLY + -

                    DBMS_LOGMNR.PRINT_PRETTY_SQL + -

                    DBMS_LOGMNR.CONTINUOUS_MINE);

Step 4 Query the V$LOGMNR_LOGS view.

This step shows that the DBMS_LOGMNR.START_LOGMNR procedure with the

CONTINUOUS_MINE option includes all of the redo log files that have been generated so
far, as expected. (Compare the output in this step to the output in Step 2.)
SQL> SELECT FILENAME name FROM V$LOGMNR_LOGS;

NAME

------------------------------------------------------

/usr/oracle/data/db1arch_1_207_482701534.dbf

/usr/oracle/data/db1arch_1_208_482701534.dbf

/usr/oracle/data/db1arch_1_209_482701534.dbf

/usr/oracle/data/db1arch_1_210_482701534.dbf

Step 5 Query the V$LOGMNR_CONTENTS view.

To reduce the number of rows returned by the query, exclude all DML statements done in the
sys or system schema. (This query specifies a timestamp to exclude transactions that were
involved in the dictionary extraction.)

Note that all reconstructed SQL statements returned by the query are correctly translated.

SQL> SELECT USERNAME AS usr,(XIDUSN || '.' || XIDSLT || '.' || XIDSQN) as XID,

       SQL_REDO FROM V$LOGMNR_CONTENTS

       WHERE SEG_OWNER IS NULL OR SEG_OWNER NOT IN ('SYS', 'SYSTEM') AND

       TIMESTAMP > '10-jan-2003 15:59:53';

USR             XID         SQL_REDO

-----------     --------    -----------------------------------

SYS             1.2.1594    set transaction read write;

SYS             1.2.1594    create table oe.product_tracking (product_id number not null,

                            modified_time date,

                            old_list_price number(8,2),

                            old_warranty_period interval year(2) to month);

SYS             1.2.1594    commit;

SYS             1.18.1602   set transaction read write;

SYS             1.18.1602   create or replace trigger oe.product_tracking_trigger

                            before update on oe.product_information

                            for each row

                            when (new.list_price <> old.list_price or

                                  new.warranty_period <> old.warranty_period)

                            declare

                            begin

                            insert into oe.product_tracking values

                               (:old.product_id, sysdate,

                                :old.list_price, :old.warranty_period);

                            end;

SYS             1.18.1602   commit;

OE              1.9.1598    update "OE"."PRODUCT_INFORMATION"

                              set

                                "WARRANTY_PERIOD" = TO_YMINTERVAL('+08-00'),

                                "LIST_PRICE" = 100

                              where

                                "PRODUCT_ID" = 1729 and

                                "WARRANTY_PERIOD" = TO_YMINTERVAL('+05-00') and

                                "LIST_PRICE" = 80 and

                                ROWID = 'AAAHTKAABAAAY9yAAA';

OE              1.9.1598    insert into "OE"."PRODUCT_TRACKING"

                              values

                                "PRODUCT_ID" = 1729,

                                "MODIFIED_TIME" = TO_DATE('13-jan-2003 16:07:03',

                                'dd-mon-yyyy hh24:mi:ss'),

                                "OLD_LIST_PRICE" = 80,

                                "OLD_WARRANTY_PERIOD" = TO_YMINTERVAL('+05-00');

 
OE              1.9.1598    update "OE"."PRODUCT_INFORMATION"

                              set

                                "WARRANTY_PERIOD" = TO_YMINTERVAL('+08-00'),

                                "LIST_PRICE" = 92

                              where

                                "PRODUCT_ID" = 2340 and

                                "WARRANTY_PERIOD" = TO_YMINTERVAL('+05-00') and

                                "LIST_PRICE" = 72 and

                                ROWID = 'AAAHTKAABAAAY9zAAA';

OE              1.9.1598    insert into "OE"."PRODUCT_TRACKING"

                              values

                                "PRODUCT_ID" = 2340,

                                "MODIFIED_TIME" = TO_DATE('13-jan-2003 16:07:07',

                                'dd-mon-yyyy hh24:mi:ss'),

                                "OLD_LIST_PRICE" = 72,

                                "OLD_WARRANTY_PERIOD" = TO_YMINTERVAL('+05-00');

OE              1.9.1598     commit;

Step 6 End the LogMiner session.

SQL> EXECUTE DBMS_LOGMNR.END_LOGMNR();