Db2 audit events for Data Virtualization

For more granular tracking and monitoring of Data Virtualization operations, you can use audit events that the Db2 engine generates at the core of Data Virtualization.

The following Data Virtualization audit events correspond to Db2 events that create audit records in each category. To learn how to monitor data access by using the Db2 audit facility, see Monitoring user activity with auditing in Data Virtualization. To view Data Virtualization specific audit events, see Audit events for Data Virtualization.
Note: The audit log does not record actions as a result from statements that fail during the compilation phase.
Events for the AUDIT category

Generates records when the audit settings are changed.

  • data-virtualization.alter_audit_policy.udpate
  • data-virtualization.archive.update
  • data-virtualization.audit_remove.delete
  • data-virtualization.audit_replace.update
  • data-virtualization.audit_using.configure
  • data-virtualization.configure.configure
  • data-virtualization.create_audit_policy.create
  • data-virtualization.db2audit.read
  • data-virtualization.drop_audit_policy.delete
  • data-virtualization.extract.read
  • data-virtualization.flush.dete
  • data-virtualization.list_logs.read
  • data-virtualization.start.enable
  • data-virtualization.stop.disable
  • data-virtualization.update_dbm_cfg.configure
Events for the CHECKING category

Generates records during authorization checking of attempts to access or manipulate Db2 database objects or functions.

  • data-virtualization.checking_function.read
  • data-virtualization.checking_membership_in_roles.read
  • data-virtualization.checking_object.read
  • data-virtualization.checking_transfer.read
Events for the CONTEXT category

Generates records to show the operation context when a user performs a database operation. This category helps you interpret the audit log file. When you use these events with the log's event correlator field, you can trace a group of events back to a single database operation.

Note: These events are not a part of the default policy.
  • data-virtualization.context_rollback.restore
  • data-virtualization.prune_history_or_log.update
  • data-virtualization.add_node.configure
  • data-virtualization.attach.configure
  • data-virtualization.backup_db.configure
  • data-virtualization.bind.configure
  • data-virtualization.close_container_query.stop
  • data-virtualization.close_cursor.stop
  • data-virtualization.close_history_file.stop
  • data-virtualization.close_tablespace_query.stop
  • data-virtualization.commit.update
  • data-virtualization.connect.configure
  • data-virtualization.connect_reset.configure
  • data-virtualization.create_database.create
  • data-virtualization.dari_start.enable
  • data-virtualization.dari_stop.disable
  • data-virtualization.dbm_cfg_operation.configure
  • data-virtualization.describe.read
  • data-virtualization.describe_database.read
  • data-virtualization.detach.delete
  • data-virtualization.discover.update
  • data-virtualization.drop_database.delete
  • data-virtualization.enable_multipage.enable
  • data-virtualization.estimate_snapshot_size.configure
  • data-virtualization.execute.update
  • data-virtualization.execute_immediate.update
  • data-virtualization.external_cancel.stop
  • data-virtualization.fetch_container_query.read
  • data-virtualization.fetch_cursor.read
  • data-virtualization.fetch_history_file.read
  • data-virtualization.fetch_tablespace.read
  • data-virtualization.force_application.update
  • data-virtualization.get_db_cfg.read
  • data-virtualization.get_dflt_cfg.read
  • data-virtualization.get_snapshot.read
  • data-virtualization.get_tablespace_statistic.read
  • data-virtualization.hadr.update
  • data-virtualization.implicit_rebind.update
  • data-virtualization.load_msg_file.read
  • data-virtualization.load_table.read
  • data-virtualization.open_container_query.read
  • data-virtualization.open_cursor.read
  • data-virtualization.open_history_file.read
  • data-virtualization.open_tablespace_query.read
  • data-virtualization.prepare.update
  • data-virtualization.prune_recovery_history.update
  • data-virtualization.quiesce_table space.update
  • data-virtualization.read_async_log_record.read
  • data-virtualization.rebind.update
  • data-virtualization.redistribute.update
  • data-virtualization.reorg.update
  • data-virtualization.request_rollback.restore
  • data-virtualization_db_cfg.restore
  • data-virtualization.reset_monitor.restore
  • data-virtualization.restore_db.restore
  • data-virtualization.rollback.restore
  • data-virtualization.rollforward_db.update
  • data-virtualization.runstats.read
  • data-virtualization.set_appl_priority.configure
  • data-virtualization.set_monitor.configure
  • data-virtualization.set_runtime_degree.configure
  • data-virtualization.set_tablespace_containers.configure
  • data-virtualization.single_tablespace_query.read
  • data-virtualization.switch_user.configure
  • data-virtualization.unload_table.restore
  • data-virtualization.unquiesce_tablespace.restore
  • data-virtualization.update_audit.update
  • data-virtualization.update_dbm_cfg.update
  • data-virtualization.update_recovery_history.update
Events for the EXECUTE category

Generates records during the execution of SQL statements.

Note: These events are not a part of the default policy.
  • data-virtualization.rollback to savepoint.restore
  • data-virtualization.xrollback.restore
  • data-virtualization.xcommit.update
  • data-virtualization.commit.update
  • data-virtualization.connect.configure
  • data-virtualization.connect_reset.configure
  • data-virtualization.data.update
  • data-virtualization.release savepoint.update
  • data-virtualization.rollback.restore
  • data-virtualization.set savepoint.update
  • data-virtualization.statement.update
  • data-virtualization.switch user.configure
Events for the OBJMAINT category

Generates records when a user is creating, dropping and altering data objects.

  • data-virtualization.alter_object.update
  • data-virtualization.create_object.create
  • data-virtualization.drop_object.delete
  • data-virtualization.rename_object.update
Events for the SECMAINT

Generates records that are related to security maintenance including authorization actions such as grant and revoke.

  • data-virtualization.add_default_role.configure
  • data-virtualization.add_user.configure
  • data-virtualization.alter_default_role.configure
  • data-virtualization.alter_object.update
  • data-virtualization.alter_security_policy.configure
  • data-virtualization.alter_user_add_role.configure
  • data-virtualization.alter_user_authentication.configure
  • data-virtualization.alter_user_drop_role.configure
  • data-virtualization.create_object.create
  • data-virtualization.drop_default_role.configure
  • data-virtualization.drop_object.delete
  • data-virtualization.drop_user.configure
  • data-virtualization.grant.configure
  • data-virtualization.implicit_grant.configure
  • data-virtualization.implicit_revoke.configure
  • data-virtualization.rename_object.update
  • data-virtualization.revoke.configure
  • data-virtualization.set_session_user.configure
  • data-virtualization.transfer_ownership.configure
  • data-virtualization.update_dbm_cfg.configure
Events for the SYSADMIN category
Generates records for when operations that require SYSADM, SYSMAINT, or SYSCTRL authority are performed.
Note: These events are not a part of the default policy.
  • data-virtualization.uncatalog_rem_stg.configure
  • data-virtualization.rename_stogroup.update
  • data-virtualization.drop_usagelist.delete
  • data-virtualization.drop_stogroup.delete
  • data-virtualization.create_usagelist.create
  • data-virtualization.create_stogroup.create
  • data-virtualization.audit_disabled.configure
  • data-virtualization.alter_evmon.update
  • data-virtualization.catalog_rem_stg.configure
  • data-virtualization.alter_stogroup.update
  • data-virtualization.alter_usagelist.update
  • data-virtualization.activate_db.start
  • data-virtualization.add_node.update
  • data-virtualization.alter_bufferpool.update
  • data-virtualization.alter_database.update
  • data-virtualization.alter_nodegroup.update
  • data-virtualization.alter_tablespace.update
  • data-virtualization.attach_debugger.monitor
  • data-virtualization.backup_db.backup
  • data-virtualization.catalog_db.configure
  • data-virtualization.catalog_dcs_db.configure
  • data-virtualization.catalog_node.configure
  • data-virtualization.change_db_comment.update
  • data-virtualization.close_container_query.update
  • data-virtualization.close_tablespace_query.update
  • data-virtualization.commit_dsf_cfs.update
  • data-virtualization.commit_dsf_cm.update
  • data-virtualization.commit_dsf_instance.update
  • data-virtualization.create_bufferpool.create
  • data-virtualization.create_database.create
  • data-virtualization.create_db_at_node.create
  • data-virtualization.create_event_monitor.create
  • data-virtualization.create_instance.create
  • data-virtualization.create_nodegroup.create
  • data-virtualization.create_tablespace.create
  • data-virtualization.db2aud.monitor
  • data-virtualization.db2audit.monitor
  • data-virtualization.db2remot.monitor
  • data-virtualization.db2set.configure
  • data-virtualization.db2trc.monitor
  • data-virtualization.deactivate_db.stop
  • data-virtualization.delete_instance.delete
  • data-virtualization.describe_database.read
  • data-virtualization.drop_bufferpool.delete
  • data-virtualization.drop_database.delete
  • data-virtualization.drop_event_monitor.monitor
  • data-virtualization.drop_nodegroup.delete
  • data-virtualization.drop_node_verify.delete
  • data-virtualization.drop_tablespace.delete
  • data-virtualization.enable_multipage.configure
  • data-virtualization.estimate_snapshot_size.configure
  • data-virtualization.fetch_container_query.read
  • data-virtualization.fetch_tablespace.read
  • data-virtualization.force_application.update
  • data-virtualization.get_snapshot.read
  • data-virtualization.get_tablespace_statistic.read
  • data-virtualization.grant_dbadm.configure (V97: no longer generated).
  • data-virtualization.grant_dbauth.configure (V97: no longer generated).
  • data-virtualization.killdbm.stop
  • data-virtualization.list_drda_indoubt_transactions.read
  • data-virtualization.load_table.read
  • data-virtualization.maintenance_dsf_mode.configure
  • data-virtualization.merge_dbm_config_file.configure
  • data-virtualization.migrate_db.configure
  • data-virtualization.migrate_db_dir.configure
  • data-virtualization.migrate_system_directory.configure
  • data-virtualization.open_container_query.read
  • data-virtualization.open_tablespace_query.read
  • data-virtualization.prune_recovery_history.configure
  • data-virtualization.quiesce_tablespace.configure
  • data-virtualization.read_async_log_record.read
  • data-virtualization.redistribute_nodegroup.configure
  • data-virtualization.rename_tablespace.update
  • data-virtualization.reset_admin_cfg.configure
  • data-virtualization.reset_dbm_cfg.configure
  • data-virtualization.reset_db_cfg.configure
  • data-virtualization.reset_monitor.monitor
  • data-virtualization.restore_db.restore
  • data-virtualization.revoke_dbadm.configure (V97: no longer generated).
  • data-virtualization.revoke_dbauth.configure (V97: no longer generated).
  • data-virtualization.rollforward_db.restore
  • data-virtualization.set_appl_priority.configure
  • data-virtualization.set_event_monitor_state.monitor
  • data-virtualization.set_runtime_degree.configure
  • data-virtualization.set_tablespace_containers.configure
  • data-virtualization.single_tablespace_query.read
  • data-virtualization.start_cf.start
  • data-virtualization.start_db2.start
  • data-virtualization.start_dsf_instance.start
  • data-virtualization.stop_cf.stop
  • data-virtualization.stop_db2.stop
  • data-virtualization.stop_dsf_instance.stop
  • data-virtualization.uncatalog_db.configure
  • data-virtualization.uncatalog_dcs_db.configure
  • data-virtualization.uncatalog_node.configure
  • data-virtualization.unload_table.configure
  • data-virtualization.update_admin_cfg.update
  • data-virtualization.update_cli_configuration.update
  • data-virtualization.update_dsf_member_or_cf.update
  • data-virtualization.update_db_version.update
  • data-virtualization.update_dbm_cfg.update
  • data-virtualization.update_db_cfg.update
  • data-virtualization.set_monitor.monitor
  • data-virtualization.update_recovery_history.update
Events for the VALIDATE category

Generates records when you are authenticating users or retrieving system security information.

  • data-virtualization.get_roles.authenticate
  • data-virtualization.authentication.authenticate
  • data-virtualization.check_group_membership.authenticate
  • data-virtualization.get_usermapping_from_plugin.authenticate
  • data-virtualization.get_grouplist.authenticate
  • data-virtualization.get_userid.authenticate
Note:
The following events are not generated by Db2 9.5 and later, but may still appear when audit records from pre-9.5 Db2 instances are formatted:
  • data-virtualization.check_group_membership.authenticate
  • data-virtualization.get_grouplist.authenticate
  • data-virtualization.get_userid.authenticate