Re: Logging of DBA activity for SOX

SteveT68@gmail.com wrote: > Hi Guys, > > I am not an Informix DBA, but have been challenged with implementing a > logging solution for Sarbanes Oxley compliance. > > What we would like to do is log all activity on the database by the > Informix DBA's. In particular, we would like to include log on/off > activity, plus all scripts run by the DBA during their connection. > > As you will see from the above, I am no expert, in fact have never > touched Informix! What I am after is some background info, to help me > guide the DBA's in order that they do not just tell me "it can't be > done". > > Our Log collection tool, will be Network Intelligence enVision, which > supports logs from syslog, or ftp of text files from a server, or ODBC > connection to a table in the DB. > > By the way, we have similar challenges with Oracle and SQL! > > Any assistance would be much appreciated. You don't mention which database server you use, or which OS, or versions, or...... Anyway, you mention syslog, so assuming IDS on UNIX... You can use database auditing (Trusted Facility Guide) to log actions by any user. You would not audit scripts, but the commands that those scripts execute on the database server. Be careful though, auditing can be very expensive in terms of performance loss. You can implement role separation, so that the person maintaining the audit system cannot read the audit logs, and the person reviewing the audit logs cannot maintain the auditing. Sarbanes Oxley requirements are based on defining procedures and then proving that you follow them, so check whether your procedures are going to kill your database server first. You can either send audit logs to flat files or to the UNIX audit system. You can also load the flat files into a database table. There are apparently tools for sending UNIX audit logs to syslog, but I have not seen them in action yet. So in theory at least you could get IDS to send audit logs to UNIX auditing, and then to syslog, and then to enVision. Remember you are going to have to prove that you collect audit logs and that you keep them for a predefined number of days. Cheers, -- Mark. +----------------------------------------------------------+-----------+ | Mark D. Stock mailto:mdstock@MydasSolutions.com |//////// /| | |///// / //| | +-----------------------------------+//// / ///| | |We value your comments, which have |/// / ////| | |been recorded and automatically |// / /////| | |emailed back to us for our records.|/ ////////| +----------------------+-----------------------------------+-----------+