Enterasys Security Information and Event Manager, Configuration Manual

Page: 162 / 426

Configuring DSMs
146 IBM
• If you are using DB2 v9.5 and above, see Extracting Audit Data: DB2 v9.5 and
Above .
• If you are using DB2 v8.x to v9.4, see Extracting Audit Data: DB2 v8.x to v9.4
Step 3
Use the log file protocol source to pull the output instance log file and send that
information back to SIEM on a scheduled basis. SIEM then imports and processes
this file. See
Pulling Data Using Log File Protocol .
NOTE
The IBM DB2 DSM does not support the IBM z/OS mainframe operating system.
Extracting Audit
Data: DB2 v9.5 and
Above
To extract audit data when you are using IBM DB2 v9.5 and above:
Step 1
Log into a DB2 account with SYSADMIN privilege.
Step 2
Move the audit records from the database instance to the audit log:
db2audit flush
For example, the flush command response may resemble the following:
AUD00001 Operation succeeded.
Step 3
Archive and move the active instance to a new location for future extraction:
db2audit archive
For example, an archive command response may resemble the following:
Node AUD Archived or Interim Log File
Message
---- --- ------------------------------
0 AUD00001 dbsaudit.instance.log.0.20091217125028
AUD00001 Operation succeeded.
NOTE
In DB2 v9.5 and above, the archive command replaces the prune command. The
archive command moves the active audit log to a new location, effectively pruning
all non-active records from the log. An archive command must be complete before
an extract can be performed.
Step 4
Extract the data from the archived audit log and write the data to .del files:
db2audit extract delasc from files
db2audit.instance.log.0.200912171528
For example, an archive command response may resemble the following:
AUD00001 Operation succeeded.
NOTE
Double-quotation marks (“) are used as the default text delimiter in the ASCII files,
do not change the delimiter.