From IBM DB2 V10.5 LUW Security Technical Implementation Guide
Part of SRG-APP-000381-DB-000361
Associated with: CCI-001814
Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions.
To audit changes in configuration, the SYSADMIN category needs to be audited at both the instance level and the database level.
Run the following command to ensure that the SYSADMIN category is being audited at the instance level:
$db2audit describe
If Log system administrator events is not set to “Both”, this is a finding.
Run the following SQL statement to ensure that an audit policy exists at the database level:
DB2> SELECT AUDITPOLICYNAME, AUDITPOLICYID
FROM SYSCAT.AUDITUSE
WHERE OBJECTTYPE = ' '
If no rows are returned, this is a finding.
For the audit policy returned in the statement above, run the following SQL statement to confirm that the SYSADMIN category is part of that policy and the ERROR TYPE='A':
DB2> SELECT AUDITPOLICYNAME, SYSADMINSTATUS, CONTEXTSTATUS, ERRORTYPE AS ERRORTYPE
FROM SYSCAT.AUDITPOLICIES
WHERE AUDITPOLICYID =
Run the following command to set the auditing at the instance level:
$db2audit configure scope sysadmin status both error type audit
Run the following command to set the auditing at the database level:
DB2> CREATE AUDIT POLICY
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer