When an audit record is extracted from the audit log using the DELASC extract option, each record will have one of the formats shown in the following tables. Each table will begin by showing the contents of a sample record. The description of each item of the record is shown one row at a time in the associated table. If the item is important, the name of the item will be highlighted (bold). These items contain information that are of most interest to you.
Notes:
Table 24. Audit Record Layout for AUDIT Events
timestamp=1998-06-24-11.54.05.151232;category=AUDIT;audit event=START; event correlator=0;event status=0; userid=boss;authid=BOSS; | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
AUDIT |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: CONFIGURE, DB2AUD, EXTRACT, FLUSH, PRUNE, START, STOP, and UPDATE_ADMIN_CFG |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Event Status | INTEGER | Status of audit event, represented by an SQLCODE where
Successful event > = 0 Failed event < 0 |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Table 25. Audit Record Layout for CHECKING Events
timestamp=1998-06-24-08.42.11.622984;category=CHECKING;audit event=CHECKING_OBJECT; event correlator=2;event status=0; database=FOO;userid=boss;authid=BOSS; application id=*LOCAL.newton.980624124210;application name=testapp; object name=FOO;object type=DATABASE; access approval reason=DATABASE;access attempted=CONNECT; | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
CHECKING |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: CHECKING_OBJECT and CHECKING_FUNCTION |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Event Status | INTEGER | Status of audit event, represented by an SQLCODE where
Successful event > = 0 Failed event < 0 |
Database Name | CHAR(8) | Name of the database for which the event was generated. Blank if this was an instance level audit event. |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Origin Node Number | SMALLINT | Node number at which the audit event occurred. |
Coordinator Node Number | SMALLINT | Node number of the coordinator. |
Application ID | VARCHAR (255) | Application ID in use at the time the audit event occurred. |
Application Name | VARCHAR (1024) | Application Name in use at the time the audit event occurred. |
Package Schema | VARCHAR (128) | Schema of the package in use at the time of the audit event. |
Package Name | VARCHAR (128) | Name of package in use at the time the audit event occurred. |
Package Section Number | SMALLINT | Section number in package being used at the time the audit event occurred. |
Object Schema | VARCHAR (128) | Schema of the object for which the audit event was generated. |
Object Name | VARCHAR (128) | Name of object for which the audit event was generated. |
Object Type | VARCHAR (32) | Type of object for which the audit event was generated. Possible values include: TABLE, VIEW, ALIAS, FUNCTION, INDEX, PACKAGE, DATA_TYPE, NODEGROUP, SCHEMA, STORED_PROCEDURE, BUFFERPOOL, TABLESPACE, EVENT_MONITOR, TRIGGER, DATABASE, INSTANCE, FOREIGN_KEY, PRIMARY_KEY, UNIQUE_CONSTRAINT, CHECK_CONSTRAINT, WRAPPER, SERVER, NICKNAME, USER MAPPING, SERVER OPTION, TYPE MAPPING, FUNCTION MAPPING, SUMMARY TABLES, and NONE. |
Access Approval Reason | CHAR(18) | Indicates the reason why access was approved for this audit event. Possible values include: Those shown in the first list following this table. |
Access Attempted | CHAR(18) | Indicates the type of access that was attempted. Possible values include: Those shown in the second list following this table. |
The following is the list of possible CHECKING access approval reasons:
The following is the list of possible CHECKING access attempted types:
Table 26. Audit Record Layout for OBJMAINT Events
timestamp=1998-06-24-08.42.41.957524;category=OBJMAINT;audit event=CREATE_OBJECT; event correlator=3;event status=0; database=FOO;userid=boss;authid=BOSS; application id=*LOCAL.newton.980624124210;application name=testapp; package schema=NULLID;package name=SQLC28A1; package section=0;object schema=BOSS;object name=AUDIT;object type=TABLE; | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
OBJMAINT |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: CREATE_OBJECT and DROP_OBJECT |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Event Status | INTEGER | Status of audit event, represented by an SQLCODE where
Successful event > = 0 Failed event < 0 |
Database Name | CHAR(8) | Name of the database for which the event was generated. Blank if this was an instance level audit event. |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Origin Node Number | SMALLINT | Node number at which the audit event occurred. |
Coordinator Node Number | SMALLINT | Node number of the coordinator. |
Application ID | VARCHAR (255) | Application ID in use at the time the audit event occurred. |
Application Name | VARCHAR (1024) | Application Name in use at the time the audit event occurred. |
Package Schema | VARCHAR (128) | Schema of the package in use at the time of the audit event. |
Package Name | VARCHAR (128) | Name of package in use at the time the audit event occurred. |
Package Section Number | SMALLINT | Section number in package being used at the time the audit event occurred. |
Object Schema | VARCHAR (128) | Schema of the object for which the audit event was generated. |
Object Name | VARCHAR (128) | Name of object for which the audit event was generated. |
Object Type | VARCHAR (32) | Type of object for which the audit event was generated. Possible values include: TABLE, VIEW, ALIAS, FUNCTION, INDEX, PACKAGE, DATA_TYPE, NODEGROUP, SCHEMA, STORED_PROCEDURE, BUFFERPOOL, TABLESPACE, EVENT_MONITOR, TRIGGER, DATABASE, INSTANCE, FOREIGN_KEY, PRIMARY_KEY, UNIQUE_CONSTRAINT, CHECK_CONSTRAINT, WRAPPER, SERVER, NICKNAME, USER MAPPING, SERVER OPTION, TYPE MAPPING, FUNCTION MAPPING, SUMMARY TABLES, and NONE. |
Table 27. Audit Record Layout for SECMAINT Events
timestamp=1998-06-24-11.57.45.188101;category=SECMAINT;audit event=GRANT; event correlator=4;event status=0; database=FOO;userid=boss;authid=BOSS; application id=*LOCAL.boss.980624155728;application name=db2bp; package schema=NULLID;package name=SQLC28A1; package section=0;object schema=BOSS;object name=T1;object type=TABLE; grantor=BOSS;grantee=WORKER;grantee type=USER;privilege=SELECT; | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
SECMAINT |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: GRANT, REVOKE, IMPLICIT_GRANT, IMPLICIT_REVOKE, and UPDATE_DBM_CFG. |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Event Status | INTEGER | Status of audit event, represented by an SQLCODE where
Successful event > = 0 Failed event < 0 |
Database Name | CHAR(8) | Name of the database for which the event was generated. Blank if this was an instance level audit event. |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Origin Node Number | SMALLINT | Node number at which the audit event occurred. |
Coordinator Node Number | SMALLINT | Node number of the coordinator. |
Application ID | VARCHAR (255) | Application ID in use at the time the audit event occurred. |
Application Name | VARCHAR (1024) | Application Name in use at the time the audit event occurred. |
Package Schema | VARCHAR (128) | Schema of the package in use at the time of the audit event. |
Package Name | VARCHAR (128) | Name of package in use at the time the audit event occurred. |
Package Section Number | SMALLINT | Section number in package being used at the time the audit event occurred. |
Object Schema | VARCHAR (128) | Schema of the object for which the audit event was generated. |
Object Name | VARCHAR (128) | Name of object for which the audit event was generated. |
Object Type | VARCHAR (32) | Type of object for which the audit event was generated. Possible values include: TABLE, VIEW, ALIAS, FUNCTION, INDEX, PACKAGE, DATA_TYPE, NODEGROUP, SCHEMA, STORED_PROCEDURE, BUFFERPOOL, TABLESPACE, EVENT_MONITOR, TRIGGER, DATABASE, INSTANCE, FOREIGN_KEY, PRIMARY_KEY, UNIQUE_CONSTRAINT, CHECK_CONSTRAINT, WRAPPER, SERVER, NICKNAME, USER MAPPING, SERVER OPTION, TYPE MAPPING, FUNCTION MAPPING, SUMMARY TABLES, and NONE. |
Grantor | VARCHAR (128) | Grantor ID. |
Grantee | VARCHAR (128) | Grantee ID for which a privilege or authority was granted or revoked. |
Grantee Type | VARCHAR (32) | Type of the grantee that was granted to or revoked from. Possible values include: USER, GROUP, or BOTH. |
Privilege or Authority | CHAR(18) | Indicates the type of privilege or authority granted or revoked. Possible values include: Those shown in the list following this table. |
The following is the list of possible SECMAINT privileges or authorities:
Table 28. Audit Record Layout for SYSADMIN Events
timestamp=1998-06-24-11.54.04.129923;category=SYSADMIN;audit event=DB2AUDIT; event correlator=1;event status=0; userid=boss;authid=BOSS; application id=*LOCAL.boss.980624155404;application name=db2audit; | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
SYSADMIN |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: Those shown in the list following this table. |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Event Status | INTEGER | Status of audit event, represented by an SQLCODE where
Successful event > = 0 Failed event < 0 |
Database Name | CHAR(8) | Name of the database for which the event was generated. Blank if this was an instance level audit event. |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Origin Node Number | SMALLINT | Node number at which the audit event occurred. |
Coordinator Node Number | SMALLINT | Node number of the coordinator. |
Application ID | VARCHAR (255) | Application ID in use at the time the audit event occurred. |
Application Name | VARCHAR (1024) | Application Name in use at the time the audit event occurred. |
Package Schema | VARCHAR (128) | Schema of the package in use at the time of the audit event. |
Package Name | VARCHAR (128) | Name of package in use at the time the audit event occurred. |
Package Section Number | SMALLINT | Section number in package being used at the time the audit event occurred. |
The following is the list of possible SYSADMIN audit events:
Table 29. SYSADMIN Audit Events
START_DB2 STOP_DB2 CREATE_DATABASE DROP_DATABASE UPDATE_DBM_CFG UPDATE_DB_CFG CREATE_TABLESPACE DROP_TABLESPACE ALTER_TABLESPACE CREATE_NODEGROUP DROP_NODEGROUP ALTER_NODEGROUP CREATE_BUFFERPOOL DROP_BUFFERPOOL ALTER_BUFFERPOOL CREATE_EVENT_MONITOR DROP_EVENT_MONITOR ENABLE_MULTIPAGE MIGRATE_DB_DIR DB2TRC DB2SET ACTIVATE_DB ADD_NODE BACKUP_DB CATALOG_NODE CATALOG_DB CATALOG_DCS_DB CHANGE_DB_COMMENT DEACTIVATE_DB DROP_NODE_VERIFY FORCE_APPLICATION GET_SNAPSHOT LIST_DRDA_INDOUBT_TRANSACTIONS MIGRATE_DB RESET_ADMIN_CFG RESET_DB_CFG RESET_DBM_CFG RESET_MONITOR RESTORE_DB |
ROLLFORWARD_DB SET_RUNTIME_DEGREE SET_TABLESPACE_CONTAINERS UNCATALOG_DB UNCATALOG_DCS_DB UNCATALOG_NODE UPDATE_ADMIN_CFG UPDATE_MON_SWITCHES LOAD_TABLE DB2AUDIT SET_APPL_PRIORITY CREATE_DB_AT_NODE KILLDBM MIGRATE_SYSTEM_DIRECTORY DB2REMOT DB2AUD MERGE_DBM_CONFIG_FILE UPDATE_CLI_CONFIGURATION OPEN_TABLESPACE_QUERY SINGLE_TABLESPACE_QUERY CLOSE_TABLESPACE_QUERY FETCH_TABLESPACE OPEN_CONTAINER_QUERY FETCH_CONTAINER_QUERY CLOSE_CONTAINER_QUERY GET_TABLESPACE_STATISTICS DESCRIBE_DATABASE ESTIMATE_SNAPSHOT_SIZE READ_ASYNC_LOG_RECORD PRUNE_RECOVERY_HISTORY UPDATE_RECOVERY_HISTORY QUIESCE_TABLESPACE UNLOAD_TABLE UPDATE_DATABASE_VERSION CREATE_INSTANCE DELETE_INSTANCE SET_EVENT_MONITOR GRANT_DBADM REVOKE_DBADM GRANT_DB_AUTHORITIES REVOKE_DB_AUTHORITIES REDIST_NODEGROUP |
Table 30. Audit Record Layout for VALIDATE Events
timestamp=1998-06-24-08.42.11.527490;category=VALIDATE;audit event=CHECK_GROUP_MEMBERSHIP; event correlator=2;event status=-1092; database=FOO;userid=boss;authid=BOSS;execution id=newton; application id=*LOCAL.newton.980624124210;application name=testapp; auth type=SERVER; | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
VALIDATE |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: GET_GROUPS, GET_USERID, AUTHENTICATE_PASSWORD, and VALIDATE_USER. |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Event Status | INTEGER | Status of audit event, represented by an SQLCODE where
Successful event > = 0 Failed event < 0 |
Database Name | CHAR(8) | Name of the database for which the event was generated. Blank if this was an instance level audit event. |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Execution ID | VARCHAR(1024) | Execution ID in use at the time of the audit event. |
Origin Node Number | SMALLINT | Node number at which the audit event occurred. |
Coordinator Node Number | SMALLINT | Node number of the coordinator. |
Application ID | VARCHAR (255) | Application ID in use at the time the audit event occurred. |
Application Name | VARCHAR (1024) | Application Name in use at the time the audit event occurred. |
Authentication Type | VARCHAR (32) | Authentication type at the time of the audit event. |
Package Schema | VARCHAR (128) | Schema of the package in use at the time of the audit event. |
Package Name | VARCHAR (128) | Name of package in use at the time the audit event occurred. |
Package Section Number | SMALLINT | Section number in package being used at the time the audit event occurred. |
Table 31. Audit Record Layout for CONTEXT Events
timestamp=1998-06-24-08.42.41.476840;category=CONTEXT;audit event=EXECUTE_IMMEDIATE; event correlator=3; database=FOO;userid=boss;authid=BOSS; application id=*LOCAL.newton.980624124210;application name=testapp; package schema=NULLID;package name=SQLC28A1; package section=203;text=create table audit(c1 char(10), c2 integer); | ||
---|---|---|
NAME | FORMAT | DESCRIPTION |
Timestamp | CHAR(26) | Date and time of the audit event. |
Category | CHAR(8) | Category of audit event. Possible values are:
CONTEXT |
Audit Event | VARCHAR(32) | Specific Audit Event.
Possible values include: Those shown in the list following this table. |
Event Correlator | INTEGER | Correlation identifier for the operation being audited. Can be used to identify what audit records are associated with a single event. |
Database Name | CHAR(8) | Name of the database for which the event was generated. Blank if this was an instance level audit event. |
User ID | VARCHAR(1024) | User ID at time of audit event. |
Authorization ID | VARCHAR(128) | Authorization ID at time of audit event. |
Origin Node Number | SMALLINT | Node number at which the audit event occurred. |
Coordinator Node Number | SMALLINT | Node number of the coordinator. |
Application ID | VARCHAR (255) | Application ID in use at the time the audit event occurred. |
Application Name | VARCHAR (1024) | Application Name in use at the time the audit event occurred. |
Package Schema | VARCHAR (128) | Schema of the package in use at the time of the audit event. |
Package Name | VARCHAR (128) | Name of package in use at the time the audit event occurred. |
Package Section Number | SMALLINT | Section number in package being used at the time the audit event occurred. |
Statement Text (statement) | CLOB (32K) | Text of the SQL statement, if applicable. Null if no SQL statement text is available. |
The following is the list of possible CONTEXT audit events:
Table 32. CONTEXT Audit Events
CONNECT CONNECT_RESET ATTACH DETACH DARI_START DARI_STOP BACKUP_DB RESTORE_DB ROLLFORWARD_DB OPEN_TABLESPACE_QUERY FETCH_TABLESPACE CLOSE_TABLESPACE_QUERY OPEN_CONTAINER_QUERY CLOSE_CONTAINER_QUERY FETCH_CONTAINER_QUERY SET_TABLESPACE_CONTAINERS GET_TABLESPACE_STATISTIC READ_ASYNC_LOG_RECORD QUIESCE_TABLESPACE LOAD_TABLE UNLOAD_TABLE UPDATE_RECOVERY_HISTORY PRUNE_RECOVERY_HISTORY SINGLE_TABLESPACE_QUERY LOAD_MSG_FILE UNQUIESCE_TABLESPACE ENABLE_MULTIPAGE DESCRIBE_DATABASE DROP_DATABASE CREATE_DATABASE ADD_NODE FORCE_APPLICATION |
SET_APPL_PRIORITY RESET_DB_CFG GET_DB_CFG GET_DFLT_CFG UPDATE_DBM_CFG SET_MONITOR GET_SNAPSHOT ESTIMATE_SNAPSHOT_SIZE RESET_MONITOR OPEN_HISTORY_FILE CLOSE_HISTORY_FILE FETCH_HISTORY_FILE SET_RUNTIME_DEGREE UPDATE_AUDIT DBM_CFG_OPERATION DISCOVER OPEN_CURSOR CLOSE_CURSOR FETCH_CURSOR EXECUTE EXECUTE_IMMEDIATE PREPARE DESCRIBE BIND REBIND RUNSTATS REORG REDISTRIBUTE COMMIT ROLLBACK REQUEST_ROLLBACK IMPLICIT_REBIND |