Audit events

For each audit category, certain types of events can create audit records.

Events for the CHECKING category

CHECKING_FUNCTION
CHECKING_MEMBERSHIP_IN_ROLES
CHECKING_OBJECT
CHECKING_TRANSFER

Events for the CONTEXT category

ADD_NODE
ATTACH
BACKUP_DB
BIND
CLOSE_CONTAINER_QUERY
CLOSE_CURSOR
CLOSE_HISTORY_FILE
CLOSE_TABLESPACE_QUERY
COMMIT
CONNECT
CONNECT_RESET
CONTEXT_ROLLBACK
CREATE_DATABASE
DARI_START
DARI_STOP
DBM_CFG_OPERATION
DESCRIBE
DESCRIBE_DATABASE
DETACH
DISCOVER
DROP_DATABASE
ENABLE_MULTIPAGE
ESTIMATE_SNAPSHOT_SIZE
EXECUTE
EXECUTE_IMMEDIATE
EXTERNAL_CANCEL
FETCH_CONTAINER_QUERY
FETCH_CURSOR
FETCH_HISTORY_FILE
FETCH_TABLESPACE
FORCE_APPLICATION
GET_DB_CFG
GET_DFLT_CFG
GET_SNAPSHOT
GET_TABLESPACE_STATISTIC
IMPLICIT_REBIND
LOAD_MSG_FILE
LOAD_TABLE
OPEN_CONTAINER_QUERY
OPEN_CURSOR
OPEN_HISTORY_FILE
OPEN_TABLESPACE_QUERY
PREPARE
PRUNE_HISTORY_OR_LOG - An attempt to delete entries from the recovery history file or to delete log files from the active log file path has been made.
PRUNE_RECOVERY_HISTORY
QUIESCE_TABLESPACE
READ_ASYNC_LOG_RECORD
REBIND
REDISTRIBUTE
REORG
REQUEST_ROLLBACK
RESET_DB_CFG
RESET_MONITOR
RESTORE_DB
ROLLBACK
ROLLFORWARD_DB
RUNSTATS
SET_APPL_PRIORITY
SET_MONITOR
SET_RUNTIME_DEGREE
SET_TABLESPACE_CONTAINERS
SINGLE_TABLESPACE_QUERY
SWITCH_USER
UNLOAD_TABLE
UNQUIESCE_TABLESPACE
UPDATE_AUDIT
UPDATE_DBM_CFG
UPDATE_RECOVERY_HISTORY

Events for the EXECUTE category

COMMIT - The running of a COMMIT statement.
CONNECT - Establishment of a database connection.
CONNECT RESET - Termination of a database connection.
DATA - A host variable or parameter marker data values for the statement.
This event is repeated for each host variable or parameter marker that is part of the statement. It is only present in a delimited extract of an audit log.
RELEASE SAVEPOINT - The running of a RELEASE SAVEPOINT statement.
ROLLBACK - The running of a ROLLBACK statement.
ROLLBACK TO SAVEPOINT - The running of a ROLLBACK TO SAVEPOINT statement.
SET SAVEPOINT - The running of a SET SAVEPOINT statement.
STATEMENT - The running of an SQL statement.
SWITCH USER - Switching of a user within a trusted connection.
XCOMMIT - The running of a XACOMMIT statement within an XA transaction.
XROLLBACK - The running of a XAROLLBACK statement within an XA transaction.

Events for the OBJMAINT category

ALTER_OBJECT - The altering of a protected table or module
CREATE_OBJECT
DROP_OBJECT
RENAME_OBJECT

Events for the SYSADMIN category

ACTIVATE_DB
ADD_NODE
ALTER_BUFFERPOOL
ALTER_DATABASE
ALTER_NODEGROUP
ALTER_STOGROUP - An attempt to alter the definition of a storage group has been made.
ALTER_TABLESPACE
ALTER_USAGELIST - An attempt to alter the definition of a usage list has been made.
ATTACH_DEBUGGER
BACKUP_DB
CATALOG_DB
CATALOG_DCS_DB
CATALOG_NODE
CATALOG_REM_STG - An attempt to catalog remote storage has been made.
CHANGE_DB_COMMENT
CLOSE_CONTAINER_QUERY
CLOSE_TABLESPACE_QUERY
COMMIT_DSF_CFS
COMMIT_DSF_CM
COMMIT_DSF_INSTANCE
CREATE_BUFFERPOOL
CREATE_DATABASE
CREATE_DB_AT_NODE
CREATE_EVENT_MONITOR
CREATE_INSTANCE
CREATE_NODEGROUP
CREATE_STOGROUP - An attempt to create a storage group has been made.
CREATE_TABLESPACE
CREATE_USAGELIST - An attempt to create a usage list has been made.
DB2AUD
DB2AUDIT
DB2REMOT
DB2SET
DB2TRC
DEACTIVATE_DB
DELETE_INSTANCE
DESCRIBE_DATABASE
DROP_BUFFERPOOL
DROP_DATABASE
DROP_EVENT_MONITOR
DROP_NODEGROUP
DROP_NODE_VERIFY
DROP_STOGROUP - An attempt to drop a storage group has been made.
DROP_TABLESPACE
DROP_USAGELIST - An attempt to drop a usage list has been made.
ENABLE_MULTIPAGE
ESTIMATE_SNAPSHOT_SIZE
FETCH_CONTAINER_QUERY
FETCH_TABLESPACE
FORCE_APPLICATION
GET_SNAPSHOT
GET_TABLESPACE_STATISTIC
GRANT_DBADM (V97:no longer generated)
GRANT_DBAUTH (V97:no longer generated)
KILLDBM
LIST_DRDA_INDOUBT_TRANSACTIONS
LOAD_TABLE
MAINTENANCE_DSF_MODE
MERGE_DBM_CONFIG_FILE
MIGRATE_DB
MIGRATE_DB_DIR
MIGRATE_SYSTEM_DIRECTORY
OPEN_CONTAINER_QUERY
OPEN_TABLESPACE_QUERY
PRUNE_RECOVERY_HISTORY
QUIESCE_TABLESPACE
READ_ASYNC_LOG_RECORD
REDISTRIBUTE_NODEGROUP
RENAME_STOGROUP - An attempt to rename a storage group has been made.
RENAME_TABLESPACE
RESET_ADMIN_CFG
RESET_DBM_CFG
RESET_DB_CFG
RESET_MONITOR
RESTORE_DB
REVOKE_DBADM (V97:no longer generated)
REVOKE_DBAUTH (V97:no longer generated)
ROLLFORWARD_DB
SET_APPL_PRIORITY
SET_EVENT_MONITOR_STATE
SET_RUNTIME_DEGREE
SET_TABLESPACE_CONTAINERS
SINGLE_TABLESPACE_QUERY
START_CF
START_DB2
START_DSF_INSTANCE
STOP_CF
STOP_DB2
STOP_DSF_INSTANCE
UNCATALOG_DB
UNCATALOG_DCS_DB
UNCATALOG_NODE
UNCATALOG_REM_STG - An attempt to uncatalog remote storage has been made.
UNLOAD_TABLE
UPDATE_ADMIN_CFG
UPDATE_CLI_CONFIGURATION
UPDATE_DSF_MEMBER_OR_CF
UPDATE_DB_VERSION
UPDATE_DBM_CFG
UPDATE_DB_CFG
SET_MONITOR
UPDATE_RECOVERY_HISTORY

Events for the VALIDATE category

AUTHENTICATION
GET_USERMAPPING_FROM_PLUGIN

The following events are not generated by Db2 9.5 and later, but may still appear when audit records from pre-9.5 Db2 instances are formatted:

CHECK_GROUP_MEMBERSHIP
GET_GROUPLIST
GET_ROLES
GET_USERID