Enterasys Security Information and Event Manager, Configuration Manual

Page: 163 / 426

Configuring DSMs
IBM DB2 147
Step 5
Move the .del files to a storage location where SIEM can pull the file. The
movement of the comma-delimited (.del) files should be synchronized with the file
pull interval in SIEM.
You are now ready to configure SIEM to receive DB2 log files. See Pulling Data
Using Log File Protocol .
Extracting Audit
Data: DB2 v8.x to
v9.4
To extract audit data when you are using IBM DB2 v8.x to v9.4.
Step 1
Log into a DB2 account with SYSADMIN privilege.
Step 2
Type the following start command to audit a database instance:
db2audit start
For example, the start command response may resemble the following:
AUD00001 Operation succeeded.
Step 3
Move the audit records from the instance to the audit log:
db2audit flush
For example, the flush command response may resemble the following:
AUD00001 Operation succeeded.
Step 4
Extract the data from the archived audit log and write the data to .del files:
db2audit extract delasc
For example, an archive command response may resemble the following:
AUD00001 Operation succeeded.
NOTE
Double-quotation marks (“) are used as the default text delimiter in the ASCII files,
do not change the delimiter.
Step 5
Remove non-active records:
db2audit prune all
Step 6
Move the .del files to a storage location where SIEM can pull the file. The
movement of the comma-delimited (.del) files should be synchronized with the file
pull interval in SIEM.
You are now ready to configure SIEM to receive DB2 log files. See Pulling Data
Using Log File Protocol .
Pulling Data Using
Log File Protocol
A log file protocol source allows SIEM to retrieve archived log files from a remote
host. The IBM DB2 DSM supports the bulk loading of log files using the log file
protocol source.
When configuring your IBM DB2 to use the log file protocol, make sure the
hostname or IP address configured in the IBM DB2 system is the same as