RSA Admin

Sybase integration - how it works and where can I see the actually query sent to the db?

Discussion created by RSA Admin Employee on Mar 24, 2010

Hi,

 

I'm doing some Sybase integration. The problem is that I get the error message "No tracking column".

 

Question 1: 

Sybase auditing works as follows: Logs are written to sysaudits_01. When this table is full, Sybase switches to sysaudits_02 while the logs in sysaudits_01 are copied to an archive and the table is truncated. And so on. 

 

Lets say that enVision read logs from a Sybase database once a minute. What if the logging switches from one logging table to the next within this minute, will we then loose data?

 

Example:

00:01:00 enVision reads from sysaudits_01

00:01:15  Sybase switches log table to sysaudits_02

00:01:20 Sybase truncates sysaudits_01

00:02:00 enVision reads from sysaudits_02

 

Do we loose data from 00:01:00 to 00:01:15 in this example?

 

Question 2:

I know I can find the last tracking value in E:\nic\csd\config\odbcs\"servername"\xx.last. Is there any place where I can se the tracking query that is actually sent to the database? In the logs (via message view) I only find "select max(eventtime) from sysaudits_01 select max(eventtime) from sysaudits_02 ....". I believe there must be something added to the query behind the scene in order to query the currently active sysaudits table, and I want to see this something!

 

 

Best regards, Anne Siri

Outcomes