How to audit the operation from dbaccess or isql

Posted in 2007

Summary

Chuan Lu asked how to audit dbaccess or isql activity for a bank customer without triggers. David Reed suggested a snooper program scanning sysmaster. Art Kagel pointed to IDS 11 Secure Audit enhancements. Chuan said the production system cannot upgrade and would check syssessions and syssqlcurses. Art agreed a monitor could track sessions, but frequent polling hurts performance and infrequent polling misses SQL.

Auto-generated by Claude from the posts below — may be imperfect; read the full thread.

Topics: Performance & Tuning, Server Administration, Security, Permissions & Auditing, Triggers, Constraints & Referential Integrity

CHUAN LU — Wed, 18 Jul 2007 09:29:35 — source: IIUG Forums & Mailing Lists

Hi, A bank customer want to audit the operation from dbaccess or isql? They don't want to define triggers on those tables, because triggers will heat ids performance. Do anybody has any suggestion ? thanks...

↪ replying to CHUAN LU

David Reed — Wed, 18 Jul 2007 09:36:21 — source: IIUG Forums & Mailing Lists

Some information is stored in the systables and sysmaster database. I would write like a snooper program that scan's these information and log what is needed. David Reed -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of CHUAN LU Sent: 18 July 2007 11:30 AM To: ids@iiug.org Subject: How to audit the operation from dbaccess or isql [9569] Hi, A bank customer want to audit the operation from dbaccess or isql? They don't want to define triggers on those tables, because triggers will heat ids performance. Do anybody has any suggestion ? thanks... ************************************************************************ ******* Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to CHUAN LU

ART KAGEL, — Wed, 18 Jul 2007 14:00:40 — source: IIUG Forums & Mailing Lists

Talk to IBM about iSpy and about the new features in IDS 11 (Cheetah) that were added to the Secure Audit option. Art S. Kagel ----- Original Message ----- From: Chuan Lu <ids@iiug.org> At: 7/18 5:29:50 Hi, A bank customer want to audit the operation from dbaccess or isql? They don't want to define triggers on those tables, because triggers will heat ids performance. Do anybody has any suggestion ? thanks... ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to ART KAGEL,

CHUAN LU — Thu, 19 Jul 2007 03:13:39 — source: IIUG Forums & Mailing Lists

But the custer's system is a product system, It's impossible for them to upgrade to IDS 11 or using i-spy. I have suggested them to check the columns of syssessions and syssqlcurses. If anybody still has good suggestion. Please told me. thanks...

↪ replying to CHUAN LU

ART KAGEL, — Thu, 19 Jul 2007 13:23:32 — source: IIUG Forums & Mailing Lists

They can certainly write a monitor that looks for new sessions in syssessions and tracks down the pid/host/user combination to determine who is running dbaccess/isql and from there to see what SQL they are running. However, such queries are intrusive, hurting performance, if run too frequently and if they are not run frequently enough then much is missed. That's why IDS 11 has new built-in monitoring and data gathering/triggering features and enhanced audit facilities. FWIW. Art S. Kagel ----- Original Message ----- From: Chuan Lu <ids@iiug.org> At: 7/18 23:13:52 But the custer's system is a product system, It's impossible for them to upgrade to IDS 11 or using i-spy. I have suggested them to check the columns of syssessions and syssqlcurses. If anybody still has good suggestion. Please told me. thanks... ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.

Glossary

dbaccess