easy question

Hi, I have an easy question, but I can't for the life of me solve it right now. I want to use the 'onaudit' utility but no matter what I try I get the error: "Must be an AAO or DBSSO to run this program." So I am running IDS version 9.4.TC5TL, on a windows xp box, and I am trying to run this utility on the same box as I have installed IDS. I am fairly sure that when I installed IDS I said no to role separation (is there a way to check, I assume that since the installation only created an 'informix' user account in the OS, that role separation is off) I was trying to run onaudit from an admin account on the box and I was getting this error, so I thought I will log onto the box as the informix user and run onaudit but I still get the same error? This confuses me greatly, as I see no way of providing credentials to the utility, although I am only running it from the command prompt. What am I missing? I should also say I am only running an evaluation version of IDS, could this perhaps be limiting it? but why then the error message about not being AAO or DBSSO? Any help would be greatly appreciated. cheers Dave

Chapter 2 in the "Informix Trusted Facility Guide" manual explains how to setup auditing. Dave wrote: > Hi, I have an easy question, but I can't for the life of me solve it > right now. > > I want to use the 'onaudit' utility but no matter what I try I get the > error: > > "Must be an AAO or DBSSO to run this program." > > So I am running IDS version 9.4.TC5TL, on a windows xp box, and I am > trying to run this utility on the same box as I have installed IDS. > > I am fairly sure that when I installed IDS I said no to role separation > (is there a way to check, I assume that since the installation only > created an 'informix' user account in the OS, that role separation is > off) > > I was trying to run onaudit from an admin account on the box and I was > getting this error, so I thought I will log onto the box as the > informix user and run onaudit but I still get the same error? This > confuses me greatly, as I see no way of providing credentials to the > utility, although I am only running it from the command prompt. > > What am I missing? > > I should also say I am only running an evaluation version of IDS, could > this perhaps be limiting it? but why then the error message about not > being AAO or DBSSO? > > Any help would be greatly appreciated. > > cheers > > Dave >

Well that chapter certainly does give you a lot of information, and I have read through it. It does appear to make the assumption that you can use the onaudit utility, which clearly I cannot at this stage, hence my original question still stands, and it would be great if someone could answer my actual question.

Dave wrote: > I was trying to run onaudit from an admin account on the box and I was > getting this error, so I thought I will log onto the box as the > informix user and run onaudit but I still get the same error? This > confuses me greatly, as I see no way of providing credentials to the > utility, although I am only running it from the command prompt. What's an admin account? Without role separation, you must login as user informix to run onaudit.

Well, Dave, you more or less answered your own question .... in your first mail you state "I said no to Role separation" and the FM - chapter 2 of which you have read - says: "Role separation is configured during database server installation. The DBSA, or the person who installs the database server, enforces role separation and decides which users will be the DBSSO andAAO. To find the group for the DBSA, DBSSO, or AAO, look at the appropriate subdirectory of $INFORMIXDIR on UNIX or %INFORMIXDIR% on Windows". The implication is that you need to have set role separation on at install time. You should be able to do an engine install over the top of the existing one and enable role separation without losing your data. Also in the much-read chapter 2 of the FM, under the heading "displaying the audit configuration", we are told that running the command "onaudit -c" will display a 0 or 1 for ADTMODE, signifying dis/enabled. HTH

Well it also says in the manual Privileged Users Privileged users are those users whom the database server recognizes as having additional privileges and responsibilities. These privileged users include the DBSA, DBSSO, AAO, and DBA. In addition, the users informix and root can also operate as any privileged user on database servers configured without role separation. Even with role separation, root can be a privileged user. Does this not imply that if I log into my box as the informix user (and have no role separation) then I should have the privileges of DBSSO and AAO?

I simply mean an another account on the box that has administrative privileges, and I agree that it makes no sense that this account should be able to use the onaudit utility, unless you could provide onaudit with credentials (eg that of the informix user) So as you say I should be able to log into my windows box using the informix account and run onaudit from the command prompt? Yet I cannot, as I get the error I stated in my first post. I suppose the error means that I must have turned role separation on? Are there any signs I could look for to confirm this, I thought it would create accounts for AAO and DBSSO on the box for instance, but they do not exist? Something else then?

AAO & BDSSO are group-based, not separate accounts

I have solved the problem. It seems that groups ix_aao and ix_dbsso are created when you install an IDS, but the informix user is not added to these groups, after you add users to these groups then those users can run onaudit. Annoyingly on windows xp the fact that the DBSSO and AAO users are indeed added although don't appear under control panel -> users, only when you look at users via the managemnet console. Although interstingly, these are added at all when I stated I did not want role separation. Anyway, problem solved and thanks for helping out.