Creating an Audit trace
Use your ISPF editor to create a JCL job that creates an Audit trace.
The following JCL is an example. Remember to change the setup
information (starting with Figure 1. Audit
job stream using ISPF/PDF editor
// in your JCL) as appropriate
for your installation.
EDIT ---- ANDREW.OMPE.JOBS.AUDTRC--------------------- Columns 001 072
Command ===> ________________________________________________ Scroll ===> CSR_
****** ***************************** TOP OF DATA ******************************
0001 /* JCL to produce an Audit trace */
0002 //AWOMPEA JOB (TTS1,YUS7),'ANDREW',
0003 // MSGCLASS=V,CLASS=D,NOTIFY=ANDREW
0004 // EXEC PGM=FPECMAIN
0005 //STEPLIB DD DSN=OMPE.RKANMOD,DISP=SHR
0006 //INPUTDD DD DSN=ANDREW.OMPE.TRACES.AUDIT,DISP=SHR
0007 //DPMOUTDD DD DSN=ANDREW.OMPE.OUT.AUDT1,DISP=OVR
0008 //JOBSUMDD DD SYSOUT=A
0009 //SYSIN DD *
0010 AUDIT
0011 TRACE
0012 SCOPE (MEMBER)
0013 EXEC
****** **************************** BOTTOM OF DATA ****************************
F1=Help F2=Split F3=Exit F5=Rfind F6=Rchange F7=Up
F8=Down F9=Swap F10=Left F11=Right F12=Cancel
To submit the job, type SUBMIT on the command
line and press Enter.
Example of a member-scope Audit trace
The following example shows the resulting member-scope Audit trace.
LOCATION: LOCATI_2 OMEGAMON for DB2 Performance Expert (V5R5M0) PAGE: 1-1
GROUP: GROUP_02 AUDIT TRACE REQUESTED FROM: NOT SPECIFIED
MEMBER: MEMBER_2 TO: NOT SPECIFIED
SUBSYSTEM: SYS2 ACTUAL FROM: 07/17/15 04:21:44.17
DB2 VERSION: V10 SCOPE: MEMBER PAGE DATE: 07/17/15
PRIMAUTH CORRNAME CONNTYPE
ORIGAUTH CORRNMBR INSTANCE
PLANNAME CONNECT TIMESTAMP TYPE DETAIL
-------- -------- ------------ ----------- -------- -------------------------------------------------------------------------------
AUTH_20 CORNME30 TSO 04:21:44.26 DDL TABLE NAME: NHEMP OWNER : XXASP09 CREATOR: XXASP09
ORAUTH30 'BLANK' A4F4970F2B37 DATABASE : DBASE1 TABLE OBID: 14 TYPE : ALTER
PLAN_20 CONN_20 TEXT: ALTER TABLE N HEMP AUDIT ALL
AUTH_20 CORNME30 TSO 04:23:27.14 DML TYPE : 1ST READ
ORAUTH30 'BLANK' A4F497ADC393 DATABASE: DBASE1 TABLE OBID: 7
PLAN_20 CONN_20 PAGESET : PSET1 LOG RBA : X'00000EA2CAF7'
AUTH_20 CORNME30 TSO 04:23:27.34 UTILITY NAME : LOAD ID : DSNTEX
ORAUTH30 'BLANK' A4F497ADC393 DATABASE: DBASE1 PHASE: RELOAD
PLAN_20 CONN_20 PAGESET : PSET1 TYPE : RECORD
AUTH_20 CORNME30 TSO 04:23:28.88 DML TYPE : 1ST WRITE
ORAUTH30 'BLANK' A4F497ADC393 DATABASE: DBASE1 TABLE OBID: 7
PLAN_20 CONN_20 PAGESET : PSET1 LOG RBA : X'00000EA2D200'
AUTH_20 CORNME30 TSO 04:24:04.97 AUTHFAIL AUTHID CHECKED: XXASP07 PRIVILEGE: SELECT
ORAUTH30 'BLANK' A4F497D49C07 OBJECT TYPE : TABLE REASON: 8 RC: 4
PLAN_20 CONN_20 SOURCE OBJECT : SYSDATABASE SOURCE OWNER: SYSIBM
TARGET OBJECT : SYSDATABASE TARGET OWNER: SYSIBM
TEXT: REVOKE SYSADM FROM XXASP07 BY ALL
AUTH_20 CORNME30 TSO 04:24:06.30 AUTHCNTL REVOKER: XXASP09 REASON: N/A SQLCODE: 0
ORAUTH30 'BLANK' A4F497D49C07 OBJECT TYPE: TSPACE
PLAN_20 CONN_20 TEXT: REVOKE SYSADM FROM XXASP07 BY ALL
AUTH_20 CORNME30 TSO 04:29:20.37 AUTHCHG TYPE: KERBEROS
ORAUTH30 'BLANK' A4F49D0AA847 COMMUNICATION ADDRESS TYPE: SNA REQ COMMUNICATION ADDR: FA0016354B98382
PLAN_20 CONN_20 DERIVED LOCAL USERID : LOCALLAD
PRINCIPAL NAME : /.../db2dev/mckueogh
AUTH_20 CORNME30 DRDA 04:40:14.57 BIND PACKAGE: DSNAPC3.DSNESPCS.DSNESM68.X'148C2637049FB9B0'
ORAUTH30 CN30 A4F49B66B12D TYPE: SEL-QUERY STMT# 71 ISOLATION(CS)
PLAN_20 CONN_20 TEXT: SELECT * FROM XXASP09.NHDEPT
REQLOC: LOCATI_30 DATABASE: DBASE1 TABLE OBID: 7
AUTH_20 CORNME30 DRDA 04:42:49.13 BIND PACKAGE: DSNAPC3.DSNESPCS.DSNESM68.X'148C2637049FB9B0'
ORAUTH30 CN30 A4F49B66B12F TYPE: SEL-QUERY STMT# 71 ISOLATION(CS)
PLAN_20 CONN_20 TEXT: SELECT * FROM XXASP09.NHDEPT
REQLOC: LOCATI_30 DATABASE: DBASE1 TABLE OBID: 7
AUDIT TRACE COMPLETE