auditing for Sybase IQ

Hi

How to setup auditing for IQ database (sybsecurity equivalent in ASE)? Any tips on this
matter is very much appreciated.

thanks
CS
CHANAsked:
Who is Participating?
 
drittenhCommented:
Ah!  A slight correction to my first comment on request level logging...  the "request level logging" does not actually go to the iqmsg log, but to a user-defined text file specified by the -zo commandline switch -  or alternately this can be set dynamically via sa_server_option('request_level_log_file',
'sqllog.txt');  

HTH,

- David
0
 
drittenhCommented:
Hi CS,

There is no direct equivalent for Sybase IQ - but there are a couple of ways to do some of the same things.

There are two ways of "auditing" in Sybase IQ depending on what you want to track.

Turn on "request level logging" - if all you want to do is see SQL statements, then you can cause these to go to the iqmsg log.   See the -zr, -zo, and -zs commandline/configfile switches.  You can also toggle this kind of logging on/off/change settings on-the-fly by changing the properties directly from an isql/dbisql session.  (eg:   sa_server_option('request_level_logging','SQL');   -- sets request level logging to "SQL" only.  See admin guide (vol. I if you are on IQ 15.x))

Or, if you are more interested in seeing "failed login attempts" or "changes to schema" or "permission violations" on schema...

You can enable "auditing" by setting the option:  set option public.auditing = 'ON' ;
This causes an "audit trail" to be written to the transaction log of the catalog.
You can extract this "audit trail" by backing up the catalog on the fly, and then using dbtran -g to extract the audit records.  This can be done in conjunction with a regime of daily transaction log maintenance... something like:

backup the current transaction log and "start a new one" using the dbbackup -t -r   etc, etc, etc
and then on this backed up copy run dbtran -g to extract the audit trail to a text file.

This "audit trail" can then be further post-processed to filter out what you want.

There are some shortcomings of this audit trail, and if this level of auditing does not meet your needs I encourage you to ring up Sybase support and log a case stating what your specific requirements for auditing are (unfortunately Sybase don't seem to be very good at doing this proactively without a support case, so the more people that raise cases, the better the IQ product will become.)  

HTH,

- David
0
 
CHANAuthor Commented:
thanks for your comments David. I appreciate your help.

Regards
CS
0
 
CHANAuthor Commented:
thanks David.

Warm Regards,
CS
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.