Auditing db2

Assign the audit policy to your table

- Start the audit - Now execute a query on the table

For example select from or insert into the table

- Stop the audit

- Flush the captured data from the buffer

- List the database level audit log generated in this directory

- Extract the audit information to a file (audit

aud)

SYSADM authority is required to execute db2audit command

1

Configure the instance level audit setting

AUD0000I Operation s쳮ded AUD0000I Operation s쳮ded 2 Start auditing AUD0000I Operation s쳮ded 3

Flush pending audit record into active audit log

AUD0000I Operation s쳮ded 4 Archive the audit log

Since the audit facility is independent of the DB2 database server, it will remain active even if the instance is stopped

In fact, when the instance is stopped, an audit record may be generated in the audit log

Ensure that the audit facility has been turned on by issuing the db2audit start command before using the audit utilities

The DB2 audit facility generates and permits the maintenance of an audit trail for a series of predefined database events

The records generated from this facility are kept in audit log files

The analysis of these records can reveal usage patterns which would identify system misuse

The configuration and collection parameters used by DB2 Audit Management Expert for z/OS can be administered with no special DB2 privileges needed

Audit, 2

Logs With the collection and storing of the audited data, measures need to be taken to ensure the validity and immutable nature of the audit data

, Load the,del files into a DB2 table

Database level auditing is controlled with the AUDIT statement

For additional information, see the Related links section below

The instance level audit facility must be stopped and started explicitly

When starting, the audit facility uses existing audit configuration information

In the example below, the db2audit commandis used to configure the directory where theaudit logs will be written andarchived

,db2audit configure datapath /home/bigsql/auditlogs archivepath /home/bigsql/archive Create an audit policy to cover the categories of audit records identified in step1,a