informix auditing

People, I have a question regarding auditing the of an informix instance. I have set the audit mask as following: onaudit -l 1 onaudit -p <path> onaudit -a -u _require -e +CRAM,CRTB,CRIX,DRAM,DRTB,DRIX,UPAM The auditing is working fine, however I am having an issue that creation of temporary tables are being logged in the auditing together with the creation of indexes on temp tables logged as well. Can someone please suggest me how to audit table creation without auditing temporary table creation. Possibly not auditing index creation on temp tables as well. Thanks very much for your help Regards Kenneth

"KENNETH PENZA" <kenneth.penza@gov.mt> wrote on 03/08/2005 12:19:59 AM: > I have a question regarding auditing the of an informix instance. > I have set the audit mask as following: > > > onaudit -l 1 > onaudit -p <path> > onaudit -a -u _require -e +CRAM,CRTB,CRIX,DRAM,DRTB,DRIX,UPAM> > The auditing is working fine, however I am having an issue that > creation of temporary tables are being logged in the auditing > together with the creation of indexes on temp tables logged as well. > > Can someone please suggest me how to audit table creation without > auditing temporary table creation. Possibly not auditing index > creation on temp tables as well. Dear Kenneth, Thanks for asking the question - I happen to have been looking at auditing recently, and your question helps highlight that people do use auditing (which is surprisingly seldom the case, though I expect the amount of auditing done to increase given the current US regulatory environment). The short answer is that I don't think you can prevent IDS from auditing the creation of temporary tables or the indexes on temporary tables. The more serious question is can you identify when a table is a temporary table - and does the implicit drop at end of session get audited? The answer to the first seems to be 'yes - the tabid value on a temporary table is 0, but a permanent table gets a non-zero tabid'. The implicit drop does not get audited. Also, if you do 'BEGIN WORK; CREATE TABLE pqr(a INT); ROLLBACK;', the implicit drop caused by the rollback does not get audited. You might, therefore, want to add BGTX and RLTX to the auditing information - or you might not. The CRIX mnemonic records -1 for the tabid when the table is temporary; it records the real tabid when the table is permanent. When you drop a table, the indexes are just droppped; they are not separately audited events. HTH. -- Jonathan Leffler (jleffler@us.ibm.com) STSM, Informix Database Engineering, IBM Information Management Division 4100 Bohannon Drive, Menlo Park, CA 94025 Tel: +1 650-926-6921 Tie-Line: 630-6921 "I don't suffer from insanity; I enjoy every minute of it!"