Auditing

Informix 11.7FC7 HP - PA-RISC I want to use the Auditing functionality of IDS to keep track of all changes on a database excluding insert,update and delete events. The Auditing should also include Informix(DBSSA). I have tried the level 7 option but it does not exclude the insert,update and delete events. Any help will be appreciated. Thanks

Use an audit mask (onaudit's -e option) to include or exclude events you want to mask or not mask. Art Art S. Kagel, Principal Consultant ASK Database Management Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Mon, Aug 25, 2014 at 9:24 AM, FLIP VAN WYNGAARDT <flipv@raf.co.za> wrote: > Informix 11.7FC7 > HP - PA-RISC > > I want to use the Auditing functionality of IDS to keep track of all > changes > on a database excluding insert,update and delete events. The Auditing > should > also include Informix(DBSSA). I have tried the level 7 option but it does > not > exclude the insert,update and delete events. > > Any help will be appreciated. > > Thanks > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a11345f040f93350501742dfa

By deaful L7 will audit DBSSO and DBSSA actions (all). Either use L1 and create the masks that include everything except that, or use L7 and put those actions in the exclude mask (although I'd need to test this as I recall something weird with the exclude mask...) Please try it. If you need further help come back... and I'll test it myself. Regards On Mon, Aug 25, 2014 at 3:24 PM, FLIP VAN WYNGAARDT <flipv@raf.co.za> wrote: > Informix 11.7FC7 > HP - PA-RISC > > I want to use the Auditing functionality of IDS to keep track of all > changes > on a database excluding insert,update and delete events. The Auditing > should > also include Informix(DBSSA). I have tried the level 7 option but it does > not > exclude the insert,update and delete events. > > Any help will be appreciated. > > Thanks > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --089e010d8dd6880044050174309b

Hi Fernando, Art, Thanks very much for your response. I am trying to exclude some events from Auditing but it does not seem to work. I have tried the following : onaudit -m -u _exclude -e +DLRW,INRW,RDRW,UPRW onaudit -m -u _default -e -DLRW,INRW,RDRW,UPRW I am not sure if this is correct.

As far as I can tell the _exclude mask is not applied to situations triggered by the level. In other words, it does not apply to DBSAs and DBSSOs if their actions are being logged due to the log level (3,5 or 7). So it depends on what you're trying to do: 1- If your organization doesn't have role separation, and you're auditing just to keep record of what happens, use level 1 and create the _default mask with everything except those menemonics you don't want 2- You you really want to control your DBSAs, then you can use L3 and let the DBSSO create specifc masks for the DBSA (AAOs will still control DBSSOs) In any case, don't forget the important practical rule: having the mask(s) or actions active doesn't load the system. Only the use of actions defined in the masks will load the system. If your DBSAs are not supposed to access data, having INRW, RDRW and DLRW in place will not cause any performance issue. If they do those actions, than yer, but if they aren't supposed to use them.... Regards. On Tue, Aug 26, 2014 at 11:14 AM, FLIP VAN WYNGAARDT <flipv@raf.co.za> wrote: > Hi Fernando, Art, > > Thanks very much for your response. > I am trying to exclude some events from Auditing but it does not seem to > work. > I have tried the following : > > onaudit -m -u _exclude -e +DLRW,INRW,RDRW,UPRW > onaudit -m -u _default -e -DLRW,INRW,RDRW,UPRW> > I am not sure if this is correct. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --bcaec51869dc618ea505018b25cf