AUDIT_DELIM_EXTRACT - performs extract to delimited file
The AUDIT_DELIM_EXTRACT stored procedure performs an extract to a delimited file on archived audit files of the connected database. Specifically, to those archived audit files that have filenames that match the specified mask pattern.
Syntax
The schema is SYSPROC.
Procedure parameters
- delimiter
- An optional input argument of type VARCHAR(1) that specifies the character delimiter to be used in the delimited files. If the argument is null or an empty string, a double quote will be used as the delimiter.
- target_directory
- An optional input argument of type VARCHAR(1024) that specifies the directory where the delimited files will be stored. If the argument is null or an empty string, same directory as the source_directory will be used
- source_directory
- An optional input argument of type VARCHAR(1024) that specifies the directory where the archived audit log files are stored. If the argument is null or an empty string, the audit default will be used.
- file_mask
- An optional input argument of type VARCHAR(1024) is a mask for which files to extract. If the
argument is null or an empty string, it will extract from all audit log files in the source
directory. If the archived logs are in the same folder as the active log, setting the parameter to
null results in trying to extract from all the logs including the active log. To avoid errors, use
the following instead to extract all archived logs:
('%.log.%.%')
- event_options
- An optional input argument of type VARCHAR(1024) that specifies the string defines which events to extract. This matches the same string in the db2audit utility. If the argument is null or an empty string, it will extract all events.
Authorization
Execute privilege on the AUDIT_DELIM_EXTRACT function.
Default PUBLIC privilege
None
Examples
Note: Audit log files contain a timestamp
as part of their naming convention.
Example 1:Performs a delimited extract on all audit log files archived on June 18th, 2007 in the default archive directory. This example is extracting just execute events, using a double quote (") character delimiter, and creating or appending the resulting extract files (<category>.del) in the $HOME/audit_delim_extract directory.
CALL SYSPROC.AUDIT_DELIM_EXTRACT(NULL, '$HOME/AUDIT_DELIM_EXTRACT', NULL,
'%20070618%', 'CATEGORY EXECUTE')