Download PDF - IBM Redbooks

After starting each audit policy, DB2 generates specific trace records (IFCIDs) specified for
the category of the audit policy. Each audit policy can be marked for automatic start during
DB2 subsystem startup. You set the DB2START column as Y. Then this audit policy is
activated automatically during the next initialization of the DB2 instance. A DB2 subsystem
can activate up to eight policies during the DB2 startup phase.
Additional information: For information about categories and trace records that are
collected during a DB2 trace, see the DB2 10 for z/OS Administration Guide, SC19-2968.
8.2.2 Collecting and formatting audit reports
All trace records during the audit are collected by using the System Management Facility
(SMF) or Generalized Trace Facility (GTF). Before you activate an audit policy, prepare those
system components to accept DB2 audit trace records. If auditing is going to be activated for
a long time, it is preferable to use SMF to collect the necessary trace data.
To collect audit data, we customized and used GTF. GTF is a base system component of the
z/OS operating system and provides service aid for recording and diagnosis of system and
product problems.
Initialization of GTF is done in internal tracking mode where data is maintained in virtual
storage and is not recorded on any external device. After GTF is stopped, all collected data
can be written to a special data set that is used to create reports. Example 8-5 shows the job
control language (JCL) for the started procedure, GTF.
Example 8-5 JCL for GTF
//GTFDB2 PROC MEMBER=GTFDB2
//IEFPROC EXEC PGM=AHLGTF,PARM='MODE=EXT,DEBUG=NO,TIME=YES',
// TIME=1440,REGION=2880K
//IEFRDER DD DSNAME=MAXIM.GTFDB2.&SYSNAME..D&YYMMDD..T&HHMMSS,
//* DISP=OLD,DCB=NCP=255
// DISP=(,CATLG),SPACE=(CYL,100,RLSE),UNIT=SYSDA
//SYSLIB DD DSNAME=SYS1.PARMLIB(&MEMBER),DISP=SHR
Example 8-6 shows the starting process of GTF in the z/OS system log (syslog).
Example 8-6 Starting process of the GTF
S GTFDB2.GTFDB2
IRR812I PROFILE ** (G) IN THE STARTED CLASS WAS USED 994
TO START GTFDB2 WITH JOBNAME GTFDB2.
$HASP100 GTFDB2 ON STCINRDR
IRR812I PROFILE ** (G) IN THE STARTED CLASS WAS USED 996
TO START GTFDB2 WITH JOBNAME GTFDB2.
IEF695I START GTFDB2 WITH JOBNAME GTFDB2 IS ASSIGNED TO USER STC
, GROUP SYS1
$HASP373 GTFDB2 STARTED
AHL121I TRACE OPTION INPUT INDICATED FROM MEMBER GTFDB2 OF PDS
SYS1.PARMLIB
TRACE=USRP
USR=(FB9)
AHL103I TRACE OPTIONS SELECTED --USR=(FB9)
023 AHL125A RESPECIFY TRACE OPTIONS OR REPLY U
R 023,U
120 Running SAP Solutions with IBM DB2 10 for z/OS on the IBM zEnterprise System