Decoding Siebel Audit Trail with PLSQL

In this post we will understand how to decode Seibel Audit Trail using PLSQL.

Siebel Audit Trail is feature in Siebel CRM which allows customer to track changes to important UI fields. Though it is very useful feature, the changes are stored in encoded text in DB. We are aiming to decode this complex data and allow user to extract complete Audit Trail information in files or tables. This can be further used to enhance customer experience.

This extract process is written completely in PL-SQL procedure. Similarly a script based solution would follow. This PL SQL procedure is tested with version 8.0 & 8.1. It should also be applicable for newer 8.1.1.16 versions as well.
So let’s get started with this. We will go step by step and understand the purpose of this code while going along with a scenario.

WHAT is Audit Trail?

More often than not, we see that few important fields are always tracked for changes in Siebel objects. Be it status of order, approver of quote, status of activity or assignee or a service request. Examples are many and change as per business requirement

Siebel has provided us with very good Audit Trail feature which helps us track these fields using audit trail and this data is displayed to us in UI. Usually we have this view hidden and shown only to the admins.

Now getting little techie, we know that Siebel has implemented this functionality via a specialized class which we cannot (obviously) modify. For most scenarios also, these functionality is perfectly good to work with and display of data to admins need not be quite user friendly.

WHY did we need to decode?

I came a scenario where I need to show changes to the customer for who displayed info needed to be directly consumable. Siebel does not fails us when audit trail is happening on a direct BC field i.e. Status of an order. But when a MVG field is updated, Audit trail logs a ROW_ID of new & old record. It does not store the data which was changed. So that was bump # 1.

Well you say if we have a row id why not make a join and fetch the data? Well, you can’t. These are some restriction with specialized class. You cannot make a join to a virtual field that is. We tried few other methods but all failed. Customer is very anxious now … Bump #2.

So what else is not logged correctly? A child BC record as well. We face same issue as above.

After looking at many alternatives, I decided to take a look at the data itself and see if I can play around. I came across, not to my surprise, special encoding of audited data.

HOW can we decode audit trail?

Table used to store Audit Information S_AUDIT_ITEM had details like BC, Operation Date, Type of operation and updated record’s ROW_ID directly stored in database columns, which was the good part. The bad part was audited data for field which was stored in BLOB field which looks something like below…

2*C19*STATUS_CD2*N111*In Progress2*O120*Ready For Automation

From above, I understood that

C1 –mean column 1

N1 –mean new value 1

O1 –mean old value 1

So a column “STATUS_CD” is getting updated from “Ready For Automation” to “In Progress”.

But actual Field Name is nowhere to see in audit trail table or even in this encoded text. So the writing on the wall said, you need to get it the hard way

Another thing which struck me was ‘1’ used after C, N & O letters. So does that mean we might have C2, C3 and if yes how will that data look? Well yes we do have C2 and C3 and it looks as complex if not more.

2*C216*ACTL_RESOLVED_TS10*X_CLEAR_CD2*N219*2015-07-24 09:00:103*1.52*O20*0*

So here we have 2 columns, ACTL_RESOLVED_TS & X_CLEAR_CD. Respectively their old and new values are also mentioned. So above scenario is when two columns of same BC were updated in single commit.

Now one more thing which you might have noticed is the way data is stored. Let’s look at in details

2*C19*STATUS_CD2*N111*In Progress2*

First we have number 2, then * then C1 (length = 2) then 9 then * and then STATUS_CD (length = 9). So system length of next string then a separator * and then string itself. This is then repeated for each string till end. First comes column then comes new value and then in the last the old value in sequence.

Well that is simple when you have single field getting updated. If you have two fields getting updated, data looks something like below…

2*C216*ACTL_RESOLVED_TS10*X_CLEAR_CD2*N219*2015-07-24 09:00:103*1.5

Difference here is column record gets repeated with next column. So string will have two column values then two new values and two old values.

So to decode this, I came up with simple logic with loops

Important Note: C N & O can easily be changed to J K & L as we have seen in few previous versions of Siebel. Procedure handles this easily.

So I started working on this logic and decoding the audit records one by one. PL/SQL is not as versatile in coding such complex code as I would have liked and arrays mainly are major cause of headache. But at the end, I was able to bend Oracle PLSQL to my wish

If you have read this much I believe you might like to give it a try based on logic flow above. I am adding my code, give it a try and let me know your how it goes.

I have tested this code for 8.1 version of Siebel and it should work with most other versions I believe. In case you have little different encoding, some tweak in code would do the job.

 

WHERE this could be used

How this can be configured

Best way I see is to configure this is a job running daily for a day’s data. But as per requirement this could be added on insert record trigger of S_AUDIT_ITEM. These way custom and actual tables are in continuous sync.

Important note: Oracle could change their encoding as need for future upgrades. If you implement this, this would be one of your upgrade considerations.

 

Solution: IT IS what you think it is! The Code.

Currently this code is only doing the DBMS output.

declare
    AuditLog varchar2(4000);
    AuditLogLen int;
    numOfOcc int;
    prevpos int;
    codedata varchar2(4000);
    myvar2 int;
    newpos int;
    lennum int;
    loopvar int;
    lent int;
    inrloop int;
    type colN is varray(10) of varchar2(200);
    type oVal is varray(10) of varchar2(200);
    type nVal is varray(10) of varchar2(200);
    ColName colN := colN();
    newValue oVal := oVal();
    oldValue nVal := nVal();
    getLength int;
    columnName varchar2(200);
    displayName colN := colN();
    BusCompName varchar2(200);
    ChildBC varchar2(200);
    OpDate varchar2(200);
    employeeId  varchar2(200);
    Oprtion   varchar2(200);
    recordId varchar2(200);  
    displayField varchar2(200); 
    fieldName varchar2(200);
    currentState varchar2(2);
    prevState varchar2(2);
    printLoop int;
begin
    dbms_output.put_line('Business Component-Child Business Comp-Operation Date-Employee Id-Operation-Field Name-New Value-Old Value-Record Id');
    for x in ( select BUSCOMP_NAME,CHILD_BC_NAME,OPERATION_DT, USER_ID, RECORD_ID,OPERATION_CD,to_char(substr(audit_log,0,3999)) AuditTrailStr from siebel.s_audit_item where record_id in '1')
    loop
        BusCompName:= x.BUSCOMP_NAME;
        ChildBC := x.CHILD_BC_NAME;
        OpDate := x.OPERATION_DT;
        employeeId := x.USER_ID;
        Oprtion := x.OPERATION_CD;
        recordId := x.RECORD_ID;
        AuditLog := x.AuditTrailStr; 
        AuditLogLen:=length(AuditLog);
        numOfOcc := AuditLogLen - length(replace(AuditLog,'*',null))  ;
        loopvar:=1; 
        prevpos:= 0; 
        lent:=0;
        inrloop := 1;
        getLength := 0;
        printLoop := 0;
        loop
        exit when loopvar > numOfOcc;
            myvar2 := INSTR( AuditLog,'*',1,loopvar);
            newpos:= prevpos+lent+1;
            lennum:=myvar2-lent-prevpos-1;
            lent := to_number(substr(AuditLog,newpos,lennum));
            codedata := substr(AuditLog,myvar2+1,lent);
            currentState := substr(codedata,1,1);

            if (loopvar = 1) then  
                inrloop := substr(codedata,2); 
                prevState := currentState;    
                ColName.EXTEND(inrloop);
                displayName.EXTEND(inrloop);
                oldValue.EXTEND(inrloop);
                newValue.EXTEND(inrloop);
            elsif((prevState = 'C' or  prevState= 'O' or prevState = 'N' or  prevState= 'J' or prevState = 'K' or prevState = 'L') ) then 
               
                if inrLoop > getLength then                
                    if (prevState = 'C' or prevState = 'J')  then
                        columnName := codedata;                      
                        begin
                            select FIELD_NAME into fieldName from siebel.s_audit_field a, siebel.S_AUDIT_BUSCOMP b  where a.audit_bc_id = b.row_id and b.buscomp_name = BusCompName and a.col_name = columnName;
                        end;
                        ColName(getLength+1) := fieldName;
                    elsif (prevState = 'O' or prevState = 'K')  then
                        oldValue(getLength+1) := codedata;
                    elsif (prevState = 'N' or prevState = 'L')   then
                        newValue(getLength+1) := codedata;
                    end if;
                    getLength := getLength +1;
                else 
                    getLength := 0;
                    prevState := currentState;
                end if;
            elsif ( (currentState = 'O' or prevState = 'K')  AND (currentState = 'N' or prevState = 'L')  ) then 
                getLength := 0;
                prevState := currentState;
            end if; 
            prevpos := myvar2;
            loopvar := loopvar+1;
        end loop;
        loop     
        exit when printLoop = inrLoop;
            dbms_output.put_line(BusCompName || '-' || ChildBC || '-' || OpDate || '-' || employeeId || '-' || Oprtion || '-' || ColName(printLoop+1) || '-' || newValue(printLoop+1) || '-' || oldValue(printLoop+1) || '-' ||  recordId);
            printLoop := printLoop + 1;
        end loop;
    end loop ;
end;

Have fun coding!!

Exit mobile version