How to interpret AUDIT_DATA

[Former Member]

Hi,

I have gained access to AUDIT_DATA (BLOB) field from table BC_MSG_AUDIT.

How do I interpret its contents?

Cheers,

Earlence

[Former Member · Accepted solution]

any ideas anyone?

[venkatanarayana_vagu · Accepted solution]

Try this blog in reverse way, like jdbc to file

/people/praveen.gujjeti/blog/2010/03/28/sap-xipi-storing-binaries-images-pdfs-etc-in-the-database-blobs-using-jdbc-adapter

is the same you are expecting.

[Former Member · Accepted solution]

Yes, I have tried all these things.

I think that these audit logs are stored in some specific way and they must be decoded in that way.

Is there any SAP document that details all this??

Cheers,

Earlence

[Former Member · Accepted solution]

Hi,

As you can see from its binary signature, the stored data is a serialized java object.

So there is no reliable way to decode the content without any public agreement with SAP.

I don't know your intention is, but you will be hitting the wall.

But if you want to waste your time, here are two possible approaches that I can think of.

approach 1: object decoding

decode the serialized object to find out which java classes are used. You can probably find out the relevant class names using some editor like emacs. Then look for these classes in the deployment archives of PI. Once you have the classes, you can reconstruct the audit object.

approach 2: exploiting monitor UI

The messaging system's message monitor UI can let you retrieve some particular message and its audit entries. You can call this jsp page with the appropriate input data to retrieve the decoded audit entries. To find out which parameters you need to pass to this jsp page, you can capture the transported data while accessing this jsp page over your browser.

As I warned you, even if you get one of these approaches working, if something is slightly changed, your approach will probably have to be changed.

Best regards, Yza

[Former Member · Accepted solution]

I don't know whether someone still cares about this thread, but if so here are my comments:

Approach 1 works perfectly. The JAR references you need are:

• com.sap.aii.af.ms.svc_api.jar
• com.sap.aii.af.ms.ifc_api.jar
• soapclient.jar

The following example will illustrate the job:

package PI73Audit;
import java.io.*;
import java.sql.*;
import com.sap.engine.interfaces.messaging.api.auditlog.*;
import com.sap.engine.messaging.impl.util.auditlog.*;
public class Main
{
    public static void main(String[] args) throws Exception
    {
        Class.forName("oracle.jdbc.driver.OracleDriver");
        Connection connection = DriverManager.getConnection(
                "jdbc:oracle:thin:@dbserver:1527:XE2", "user", "pass");
        Statement stmt = connection.createStatement();
        ResultSet rs = stmt.executeQuery("select audit_data from sapsr3db.bc_msg_audit");
        while (rs.next())
        {
            InputStream is = rs.getBinaryStream(1);
            ObjectInputStream ois = new ObjectInputStream(is);
            AuditEntry[] audit = (AuditEntry[])ois.readObject();
            AuditLogEntry[] entries = new AuditLogEntry[audit.length];
            for (int i = 0; i < audit.length; ++i)
            {
                entries[i] = Helper.deserialize(audit[i]);
                System.out.println(entries[i].getTextKey());
            }
        }
    }
}

package com.sap.engine.messaging.impl.util.auditlog;
import com.sap.engine.interfaces.messaging.api.auditlog.AuditLogEntry;

public class Helper
{
    public static AuditLogEntry deserialize(AuditEntry ae)
    {
         return ae.toAuditLogEntry(null);
    }
}

Approach No. 2 is not that complicated too. There is a web service available for this purpose. But I am not a PI expert and therefor do not know it's name.

But as long as your task is not performance critical you should prefer the web service. Furthermore it will also work if the audit has not yet been written to the persistent layer so far. (In memory processing.)