Audit log format configuration

Understand the available audit log formats, compare their characteristics, and choose the format that best fits your storage, reporting, and audit analysis requirements..

Overview

Db2 Warehouse as a Service audit logs support two output formats:

  • Binary
  • Delimited ASCII (delasc)

The default format is binary.

Each format has different storage, usability, and integration characteristics. Understanding these differences can help you select the format that best fits your audit logging and reporting requirements.

Binary format

Binary format stores audit data in a compact native format.

Advantages

  • Minimal storage footprint
  • Approximately 33% less storage than delimited format
  • Reduced Cloud Object Storage (COS) consumption
  • Reduced network transfer costs
  • Efficient native audit record generation
  • Suitable for long-term archival with infrequent access
  • Single consolidated file per log sequence

Limitations

  • Not human-readable
  • Requires Db2 tooling to interpret audit records
  • More complex workflows for data extraction
  • Limited compatibility with analytics and SIEM platforms

File naming format

db2audit.db.BLUDB.log.0.<timestamp>

Example

db2audit.db.BLUDB.log.0.20260623213118421327

Delimited ASCII format (delasc)

Delimited ASCII format stores audit records as comma-delimited text files.

Format specification

  • Records use a comma (,) as the delimiter.
  • The delimiter is fixed and cannot be changed.
  • The format is designed for CSV compatibility.

Advantages

  • Human-readable format
  • Direct loading into Db2 tables
  • Native CSV compatibility
  • Compatible with spreadsheet and analytics tools
  • Compatible with reporting and SIEM platforms
  • No specialized Db2 processing required
  • Optional use of db2audit.ddl column definitions as CSV headers
  • Category-specific files simplify targeted analysis

Limitations

  • Larger storage footprint
  • Approximately 50% more storage than binary format
  • Higher Cloud Object Storage (COS) consumption
  • Higher network transfer costs
  • Additional processing overhead for formatted output generation
  • Multiple files are generated per log sequence

File naming format

db2audit.db.BLUDB.log.0.<timestamp>.<category>.del

Example

db2audit.db.BLUDB.log.0.20260623214410849325.EXECUTE.del

Delimited format creates separate files for each audit category, such as:

  • EXECUTE
  • VALIDATE
  • CONTEXT

LOB files

When the lobs_in_file parameter is set to true, additional LOB files are generated.

File naming format

db2audit.db.BLUDB.log.0.<timestamp>.auditlobs

Example

db2audit.db.BLUDB.log.0.20260627004640592785.auditlobs

LOB files are generated in addition to the primary audit log files.

It is recommended to set lobs_in_file to false so that LOB data is embedded in each category file.

Storage and cost considerations

The following estimates are based on a production workload analysis over a one-hour sampling period.

Format Hourly storage Monthly storage Annual storage
Binary 17.9 MB/hour ~13 GB/month ~157 GB/year
Delimited ASCII 26.8 MB/hour ~19 GB/month ~230 GB/year

Compared to binary format, delimited format results in:

  • Approximately 8.9 MB additional storage per hour
  • Approximately 6 GB additional storage per month
  • Approximately 73 GB additional storage per year
  • Approximately 50% higher storage consumption

Annual storage cost increase

Storage service Additional annual cost
AWS S3 Standard $1.65
IBM Cloud Object Storage Standard $1.58

Delimited format also requires approximately 50% more network bandwidth for the same audit workload volume.

Choosing an audit log format

Use binary format when

  • Storage cost minimization is the primary requirement.
  • Audit logs are used mainly for compliance or archival purposes.
  • Existing batch conversion and analysis processes are available.
  • Audit log access is infrequent.
  • A single-file output format is preferred.

Use delimited format when

  • Regular audit log investigations are required.
  • Human-readable audit data is needed.
  • CSV compatibility is required.
  • Integration with analytics or SIEM platforms is required.
  • Audit data must be consumed directly without preprocessing.
  • Category-specific analysis is beneficial.
  • Operational efficiency is more important than storage savings.

Recommendation

For most production environments, delimited format provides operational advantages through:

  • Immediate readability
  • CSV compatibility
  • Simplified integration with reporting, analytics, and SIEM tools

The additional storage cost is generally small for typical audit workloads.

Binary format remains suitable for environments where storage optimization is the primary requirement and audit data is accessed infrequently.

Retrieve the current configuration

Use the following procedure to display the current audit log format settings.

CALL DB2INST1.GET_LOG_FORMAT(?, ?);

Output parameters

Parameter Description
First parameter Log format (binary or delasc)
Second parameter LOBs in file setting (true or false)

Modify the audit log format

Use the following procedure to configure audit logs to use delimited ASCII format.

CALL DB2INST1.SET_LOG_FORMAT('delasc', false, ?);

Input parameters

Parameter Description
log_format Format type (binary or delasc)
lobs_in_file Include LOBs in file (true or false)
Third parameter Output status indicator

Implementation considerations

  • Format changes apply only to newly generated audit logs.
  • Existing audit logs retain their original format.
  • Delimited format uses a fixed comma (,) delimiter.
  • Delimited format generates multiple files per log sequence.
  • Set lobs_in_file to false unless LOB inspection is specifically required.
  • Verify available Cloud Object Storage capacity before switching to delimited format.
  • Evaluate network bandwidth requirements for high-volume audit environments.
  • Test compatibility with downstream analytics and monitoring tools before deploying changes to production systems.