Audit facility behavior

Learn about audit behavior.

Preset audit configuration

The writing of the audit records to the active log can take place synchronously or asynchronously with the occurrence of the events causing the generation of those records. The value of the audit_buf_sz database manager configuration parameter determines when the writing of audit records is done.

Since the value of audit_buf_sz is preset to 1000, the record writing is done asynchronously. The value of the audit_buf_sz when it is greater than zero is the number of 4 KB pages used to create an internal buffer. The internal buffer is used to keep a number of audit records before writing a group of them out to disk. The statement generating the audit record as a result of an audit event will not wait until the record is written to disk, and can continue its operation.

In the asynchronous case, it could be possible for audit records to remain in an unfilled buffer for some time. To prevent this from happening for an extended period, the database manager can force the writing of the audit records regularly. An authorized user of the audit facility can also flush the audit buffer with an explicit request. Also, the buffers are automatically flushed during archive operation that sends the records to Cloud Object Storage.

Viewing archived audit records

Archived audit records are stored in the configured Cloud Object Storage (COS) bucket.

If supported by your environment, you can preview audit log files directly from the user interface. To review a larger set of audit records, download the audit log files from the Cloud Object Storage bucket and process them by using a Db2 server.

If the archived audit logs are stored in binary format, extract the audit records by using the db2audit extract command. For example:

db2audit extract delasc from files <downloaded_audit_log>

For example:

db2audit extract delasc delimiter : from files /tmp/db2audit.db.BLUDB.log.0.20230620081610

You can also extract the audit records to a report file:

db2audit extract file <report_file_name> from path <path_to_audit_logs> files <audit_log_name>

For example:

db2audit extract file db2audit_report.txt from path /tmp/ files db2audit.db.BLUDB.log.0.20230620081610

If the archived audit logs are stored in delimited format, you can import the records into a Db2 table by using the Db2 IMPORT command. Filter the files that you want to import based on the audit log timestamp and retain only the records that are required for your analysis.

For more information about loading archived audit records into Db2 tables, see the Db2 documentation for IMPORT and CREATE EXTERNAL TABLE.

Managing audit facility errors

When configuring audit policies, the setting of the ERRORTYPE audit facility parameter controls how errors are managed between the Db2 database system and the audit facility. When the audit facility is active, and the setting of the ERRORTYPE audit facility parameter is AUDIT, then the audit facility is treated in the same way as any other part of Db2 database. An audit record must be written (to disk in synchronous mode; or to the audit buffer in asynchronous mode) for an audit event associated with a statement to be considered successful. Whenever an error is encountered when running in this mode, a negative SQLCODE is returned to the application for the statement generating an audit record.

If the error type is set to NORMAL, then any error from audit is ignored and the operation's SQLCODE is returned.