IDS Forum

IDS 10.00.FC11 on Sun 5.10 - Informix audit issue

Posted By: Roger Kee
Date: Friday, 2 November 2012, at 8:46 a.m.

I am trying to diagnose why we are seeing extra audit log entries for
certain remote sessions and have found the following so far:

1) Only some of the sessions from this specific remote server (same user
id) generate RDRW log entries, which should not be audited due to audit
mask settings.

2) The pid for the sessions did not exist on the local server at the time I
checked that the sessions were still running, but on the remote server it
is for the 2nd cpu vp on one of the instances there (same IDS/OS ver).

3) I double checked the other sessions for that user id/remote server,
running on the local server and while there are reads occurring they are
not being audited, which is what we expect.

4) The extra log entries only show up between certain hours, which again
leads me to believe this is not someone changing the audit mask (as one of
my co-workers suggested), but either a defect or expected
behavior for these sessions due to something I am not aware of.

The only reason this is an issue, is that we normally have a process to
compress and then scp the audit log files to another server for storage and
this broke the other day and we filled up the file system. So I
need to determine the root cause, especially after my co-worker's comments
to the customer (they are now worried that someone did this on purpose).

Any ideas on the following:

1) Are these being started by a stored procedure ?

2) Why would these particular sessions act differently in terms of auditing?

3) Is this a known defect ? (Yes, I know we are on an unsupported version)

Thanks!

--e89a8f3ba41756939e04cd828469

Messages In This Thread

• IDS 10.00.FC11 on Sun 5.10 - Informix audit issue
  Roger Kee -- Friday, 2 November 2012, at 8:46 a.m.
  • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audit is
    KARL OLIVER -- Monday, 5 November 2012, at 2:33 p.m.
    • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audi....
      Roger Kee -- Wednesday, 7 November 2012, at 9:24 a.m.
  • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audit is
    KARL OLIVER -- Wednesday, 7 November 2012, at 1:57 p.m.
    • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audi....
      Roger Kee -- Thursday, 8 November 2012, at 8:47 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.