The Audit File Data Set and Output Record
The FILE subcommand formats DB2® Audit records and writes them to sequential data sets that can be loaded into DB2 tables.
The audit FILE subcommand produces up to seven sequential variable-blocked data sets. You can use FILE to separate the various audit types by specifying one audit type per FILE subcommand.
The content of the output data set is determined by the options you specify for the FILE subcommand and by the input DB2 audit trace data processed.
Each output record is divided into several parts:
- The Standard Header section contains header data common to all records. This section is at the beginning of each record. It contains DB2 identifier information known as the correlation header. It also contains the DB2 distributed network header information associated with the record.
- The Data section lists data unique to the audit category of the record. Each audit type maps the areas of the record differently. Records which share the same header information have a repeating subtype.
File data is written to a File data set. The following types of records are created:
- Bind
- Auth Change
- Auth Control
- DDL
- Auth Failure
- SQL
- Utility
Descriptions of the layouts of these records can be found in the RKO2SAMP library under the following names:
- DGOXDBND
- Bind
- DGOXDCHG
- Auth Change
- DGOXDCNT
- Auth Control
- DGOXDDDL
- DDL
- DGOXDDML
- DML
- DGOXDFAI
- Auth Failure
- DGOXDSQL
- SQL
- DGOXDUTI
- Utility