IBM Db2 Connector

Create Audit User

Create a dedicated Db2 user for DB Audit with appropriate privileges.

                -- Create a dedicated audit user
CREATE USER dbaudit_reader USING 'secure_password';

-- Grant connect privilege
GRANT CONNECT ON DATABASE TO USER dbaudit_reader;

-- Grant access to audit tables
GRANT SELECT ON SYSIBMADM.PDLOGMSGS_LAST24HOURS TO dbaudit_reader;
GRANT SELECT ON SYSCAT.AUDITPOLICIES TO dbaudit_reader;
GRANT SELECT ON SYSCAT.AUDITUSE TO dbaudit_reader;
GRANT SELECT ON SYSCAT.EVENTMONITORS TO dbaudit_reader;

-- Grant access to activity monitor views
GRANT SELECT ON SYSIBMADM.MON_CURRENT_SQL TO dbaudit_reader;
GRANT SELECT ON SYSIBMADM.MON_DB_SUMMARY TO dbaudit_reader;
GRANT SELECT ON SYSIBMADM.MON_LOCKWAITS TO dbaudit_reader;

-- Grant EXECUTE authority on audit procedures
GRANT EXECUTE ON PROCEDURE SYSPROC.AUDIT_ARCHIVE TO dbaudit_reader;
GRANT EXECUTE ON PROCEDURE SYSPROC.AUDIT_DELIM_EXTRACT TO dbaudit_reader;
              

Configure db2audit Facility

Configure and start the Db2 audit facility (requires instance owner authority).

                -- Configure db2audit facility (as instance owner)

-- Start the audit facility
db2audit configure scope all status both errortype audit

-- Enable all audit categories
db2audit configure scope all status both categories all

-- Specify audit data path
db2audit configure datapath /db2/audit archivepath /db2/audit/archive

-- Start auditing
db2audit start

-- Verify audit configuration
db2audit describe
              

Create Audit Policies (Optional)

Create granular audit policies for specific tables and users.

                -- Create audit policy for sensitive tables
CREATE AUDIT POLICY sensitive_data_policy
  CATEGORIES EXECUTE STATUS BOTH,
             CONTEXT STATUS BOTH
  ERROR TYPE AUDIT;

-- Apply policy to specific tables
AUDIT TABLE schema.customers USING POLICY sensitive_data_policy;
AUDIT TABLE schema.transactions USING POLICY sensitive_data_policy;

-- Create policy for privileged users
CREATE AUDIT POLICY admin_policy
  CATEGORIES ALL STATUS BOTH
  ERROR TYPE AUDIT;

-- Apply to authorization IDs
AUDIT AUTHORIZATION GROUP db_admins USING POLICY admin_policy;

-- Verify active policies
SELECT * FROM SYSCAT.AUDITPOLICIES;
SELECT * FROM SYSCAT.AUDITUSE;
              

Test Connection

Verify connectivity and permissions using the Db2 CLI.

                # Test connection using db2 CLI
db2 connect to SAMPLE user dbaudit_reader using 'secure_password'

# Verify audit user can read audit tables
db2 "SELECT COUNT(*) FROM SYSCAT.AUDITPOLICIES"

# Check audit status
db2audit describe

# Disconnect
db2 disconnect SAMPLE
              

Configure in DB Audit

Add the Db2 connection in the DB Audit dashboard.

1. Navigate to Connections in DB Audit
2. Click Add Connection
3. Select IBM Db2 as the database type
4. Enter your connection details and credentials
5. Configure SSL if using encrypted connections
6. Test the connection and save