To audit or not to audit...
A DBA asked whether Informix's built-in auditing is practical, given long-standing warnings about its performance cost, now that PCI/SOX compliance may require it. One respondent who implemented auditing for a SOX-compliant client reported no major performance hit as long as you avoid auditing very high-volume events, and said the minimal event set recommended in Jonathan Leffler's presentation is easily workable. Others asked for that presentation; the link was supplied (Leffler's "Audit in IDS" talk hosted on iiug.org). No deeper configuration details were discussed.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Hello all, For years I have been told not to audit do to excessive load, or just Got the "don't do it" from folks. With the Payment Card and SOX stuff, it looks like Informix auditing (and lots of it) may be called for. What are you experiences with it? Jonathan L. had a nice presentation about using it, with great info (thanks for that). It appears to do what is required by PCI/SOX, but what have you experienced? I wish we could audit connects and specific tables....but alas... Thanks in advance for the chatter! S
Gentsch, Samuel said: > Hello all, > > For years I have been told not to audit do to excessive load, or just > Got the "don't do it" from folks. > > With the Payment Card and SOX stuff, it looks like Informix auditing > (and lots of it) may be called for. > > What are you experiences with it? > > Jonathan L. had a nice presentation about using it, with great info > (thanks for that). > > It appears to do what is required by PCI/SOX, but what have you > experienced? > > I wish we could audit connects and specific tables....but alas... > > Thanks in advance for the chatter! I had to implement auditing for a client for SOX compliance. As long as you don't audit too many high-volume activities, you won't have a major performance hit. I tried to implement auditing of the things I found in JL's presentation, but the client said that was too much and trimmed it down. I disagreed with them, but the wanted to do the minimum for SOX compliance, so I had to defer. I don't think you'll have a problem implementing the bare minimum JL recommends. -- Bye now, Obnoxio "I'm astonished anyone pays real money for this crap." -- Cosmo -- This message has been scanned for viruses and dangerous content by OpenProtect(http://www.openprotect.com), and is believed to be clean.
Is Jonathan's presentation posted someplace (iiug, maybe)? Thanks. DC > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Obnoxio The Clown > Sent: Monday, February 26, 2007 8:44 AM > To: ids@iiug.org > Subject: Re: To audit or not to audit... [8508] > > Gentsch, Samuel said: > > Hello all, > > > > For years I have been told not to audit do to excessive load, or just > > Got the "don't do it" from folks. > > > > With the Payment Card and SOX stuff, it looks like Informix auditing > > (and lots of it) may be called for. > > > > What are you experiences with it? > > > > Jonathan L. had a nice presentation about using it, with great info > > (thanks for that). > > > > It appears to do what is required by PCI/SOX, but what have you > > experienced? > > > > I wish we could audit connects and specific tables....but alas... > > > > Thanks in advance for the chatter! > > I had to implement auditing for a client for SOX compliance. As long as > you don't audit too many high-volume activities, you won't have a major > performance hit. > > I tried to implement auditing of the things I found in JL's presentation, > but the client said that was too much and trimmed it down. I disagreed > with them, but the wanted to do the minimum for SOX compliance, so I had > to defer. > > I don't think you'll have a problem implementing the bare minimum JL > recommends. > > -- > Bye now, > Obnoxio > > "I'm astonished anyone pays real money for this crap." > -- Cosmo > > -- > This message has been scanned for viruses and > dangerous content by OpenProtect(http://www.openprotect.com), and is > believed to be clean. > > > ************************************************************************ ** > ***** > Forum Note: Use "Reply" to post a response in the discussion forum.
Can some post the URL of JL presentation on auditing please ? Thanks. ----- Original Message ---- From: "Gentsch, Samuel" <SAMUEL_GENTSCH@homedepot.com> To: ids@iiug.org Sent: Tuesday, February 27, 2007 2:10:52 AM Subject: To audit or not to audit... [8507] Hello all, For years I have been told not to audit do to excessive load, or just Got the "don't do it" from folks. With the Payment Card and SOX stuff, it looks like Informix auditing (and lots of it) may be called for. What are you experiences with it? Jonathan L. had a nice presentation about using it, with great info (thanks for that). It appears to do what is required by PCI/SOX, but what have you experienced? I wish we could audit connects and specific tables....but alas... Thanks in advance for the chatter! S ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum. ________________________________________________________________________________ ____ The fish are biting. Get more visitors on your site using Yahoo! Search Marketing. http://searchmarketing.yahoo.com/arp/sponsoredsearch_v2.php
>-----Original Message----- >From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of H.G >Sent: Monday, February 26, 2007 2:46 PM >To: ids@iiug.org >Subject: Re: To audit or not to audit... [8510] >Can some post the URL of JL presentation on auditing please ? Thanks. Google: informix audit leffler Thanks, Sam (x11988)
Thanks for tip Sam. Here is URL if someone need: www.iiug.org/waiug/present/Forum2006/Presentations/Audit-in-IDS-Leffler.ppt ----- Original Message ---- From: "Gentsch, Samuel" <SAMUEL_GENTSCH@homedepot.com> To: ids@iiug.org Sent: Tuesday, February 27, 2007 7:01:40 AM Subject: RE: To audit or not to audit... [8511] >-----Original Message----- >From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of H.G >Sent: Monday, February 26, 2007 2:46 PM >To: ids@iiug.org >Subject: Re: To audit or not to audit... [8510] >Can some post the URL of JL presentation on auditing please ? Thanks. Google: informix audit leffler Thanks, Sam (x11988) ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum. ________________________________________________________________________________ ____ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091