Configuring log streaming for Db2

Important: IBM Cloud Pak® for Data Version 4.7 will reach end of support (EOS) on 31 July, 2025. For more information, see the Discontinuance of service announcement for IBM Cloud Pak for Data Version 4.X.

Upgrade to IBM Software Hub Version 5.1 before IBM Cloud Pak for Data Version 4.7 reaches end of support. For more information, see Upgrading IBM Software Hub in the IBM Software Hub Version 5.1 documentation.

After Db2 audit logging is enabled, you can create a log streaming pod to forward the audit logs to the Cloud Pak for Data audit service.

Before you begin

Enable audit logging for the Db2 service. For more information, see Configuring audit logging for Db2.

Procedure

Create environment variables for your environment.
1. Run the following command to determine the name of your active db2ucluster:
```
oc get db2ucluster -n ${PROJECT_CPD_INST_OPERANDS}
```
2. Set the db2ucluster-name environment variable to the database instance you want to configure log streaming for:
```
export DB2UCLUSTER=<db2ucluster-name>
```
3. Run the following command to determine the TLS secret of your database instance:
```
$ oc get secret -n ${PROJECT_CPD_INST_OPERANDS} | grep tls
```
4. Set the INSTANCE_TLS environment variable to the TLS secret for the database instance you want to configure log streaming for:
```
export INSTANCE_TLS=<instance-tls>
```
Run the following command to confirm that audit logging is enabled and the auditlogs PVC has been created for your deployed database.
```
oc get db2u <db2ucluster-name> -oyaml
```
Confirm that enableAudit is set to true and auditlogs PVC is added in storage configs.

Create the log stream pod:

cat << EOF | oc apply -f -
apiVersion: db2ulog.databases.ibm.com/v1alpha1
kind: Db2uLogStream
metadata:
  name: $DB2UCLUSTER
spec:
  configurations:
    - type: audit
      format: cadf
      connection: cp4d
  connections:
    cp4d:
      endpoint: https://zen-audit-svc.zen:9880/records
      credentials: $INSTANCE_TLS
      authType: tls
EOF

The log stream pod is created after applying the yaml file. You can run the following commanded to verify that the pod is now active:

$ oc get pod | grep logstream

The commanded will generate output similar to the following example:

c-db2oltp-audit-test-logstream-6fb596cd5f-5r4xd                   1/1     Running     0            43h