Call: +44 (0)1904 557620 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "A select only user causing locks?"] [Next entry: "Nice paper by Jonathan on DUAL internals and intricacies"]

Marcel-Jan has an interesting tool on his site called SQL-Gotcha

I was looking for something on google last week and whilst searching I came across a page on Marcel-Jan Krijgsman's site. I actually found it as a cached link on but I went to look directly at Marcel-Jan's site.

Marcel-Jan is the original author of the scripts on my site for checking Oracle's default passwords that are still set. My page Oracle Default Password Auditing Tool includes this PL/SQL tool. Marcel-Jan's tool that I found is called SQLGotcha 2.0 and looks quite useful. I have not had time to download the scripts yet but I will do so. A brief description of its functionality is included in the page stated. Basically Marcel-Jan wanted to be able to easily trace sessions without finding the sid and serial#. You can specify username, machine, program, Unix PID or even a table that is being accessed. The tool also has a waiting mode and can trace standard SQL Trace or event 10046 tracing. The tool can be used to keep track of traces that have been started and also to find the file name. Marcel-Jan warns that using the tool can be costly in terms of querying the dictionary. I like the idea that you can specify the tool should wait for a particular session to start-up and it will then trace it.

I am particularly interested in trace tools and tracing sessions as trace can be used to learn more about how Oracle or applications operate. This can be very useful for security investigations. I have written a paper some time back that describes many ways to set trace for your own session, others sessions and also at various different levels. It also covers all the known ways to enable and disable trace. The paper is called "How to set trace for others sessions, for your own session and at instance level".