Audit facility behavior

Preset audit configuration

The writing of the audit records to the active log can take place synchronously or asynchronously with the occurrence of the events causing the generation of those records. The value of the audit_buf_sz database manager configuration parameter determines when the writing of audit records is done.

Since the value of audit_buf_sz is preset to 65000, the record writing is done asynchronously. The value of the audit_buf_sz when it is greater than zero is the number of 4 KB pages used to create an internal buffer. The internal buffer is used to keep a number of audit records before writing a group of them out to disk. The statement generating the audit record as a result of an audit event will not wait until the record is written to disk, and can continue its operation.

In the asynchronous case, it could be possible for audit records to remain in an unfilled buffer for some time. To prevent this from happening for an extended period, the database manager can force the writing of the audit records regularly. An authorized user of the audit facility can also flush the audit buffer with an explicit request. Also, the buffers are automatically flushed during archive operation that sends the records to Cloud Object Storage.

Using Cloud Object Storage to offload archive logs

During the initial configuration, you will use the UI to set your Cloud Object Storage credentials and bucket name. You will need to test the connection with the credentials and bucket and connect successfully to proceed.

Then, you will set the collection schedule which dictates how often archived audit records will be uploaded to Cloud Object Storage. See “Archiving the audit log” topic for the recommended schedule.

In order for Db2 to begin auditing events, an audit policy must be configured to database entities.

Managing audit facility errors

When configuring audit policies, the setting of the ERRORTYPE audit facility parameter controls how errors are managed between the Db2 database system and the audit facility. When the audit facility is active, and the setting of the ERRORTYPE audit facility parameter is AUDIT, then the audit facility is treated in the same way as any other part of Db2 database. An audit record must be written (to disk in synchronous mode; or to the audit buffer in asynchronous mode) for an audit event associated with a statement to be considered successful. Whenever an error is encountered when running in this mode, a negative SQLCODE is returned to the application for the statement generating an audit record.

If the error type is set to NORMAL, then any error from audit is ignored and the operation's SQLCODE is returned.