Archives of the TeradataForum

Message Posted: Tue, 20 Jun 2006 @ 20:39:59 GMT

	<Prev	Next>		<<First	<Prev	Next>	Last>>

John,

Thank you for pointing out my mistake. I did use "Show Definition" in Teradata Administrator", but I did not recognize it was dbc.DBQLSqlTbl instead of DBQLogTbl.

1. I did the following SQLs

     Select count(*)
       from dbc.QryLog
       where CollectTimeStamp > TimeStamp '2006-06-13 09:59:59';

     Select count(*)
       from dbc.DBQLogTbl
       where CollectTimeStamp > TimeStamp '2006-06-13 09:59:59';

     Both returned 3509.


     Select count(*)
       from dbc.QryLogSQL
       where CollectTimeStamp > TimeStamp '2006-06-13 09:59:59';

     Select count(*)
        from dbc.DBQLSqlTbl
        where CollectTimeStamp > TimeStamp '2006-06-13 09:59:59';

     Both returned 3440.

69 SQLs are missing, 2 more than in this morning. Some illegal activities cannot be captured.

2. Run:

     Select count(*)
     >From dbc.DBQLogTbl a join dbc.DBQLogSqlTbl b
            on a.ProcID = b.ProcID and
               a.CollectTimeStamp = b.CollectTimeStamp
     Where a.CollectTimeStamp > TimeStamp '2006-06-13 09:59:59';

It returned 0. Obviously, The two tables use different values for CollectTimeStamp. What is the purpose to use two different values?

You answered my question why it returned 0 rows. The reason is that they use different values. For one query log, two collect time stamps. Which one is correct? For me, it is confusing at least. I cannot say there are something wrong. You can always put something there for whatever reasons. The Teradata manual does not tell the difference between the two.

Auditing is very important for some systems. I want to know how to implement it in Teradata.

Thanks,

Charles

	<Prev	Next>		<<First	<Prev	Next>	Last>>