IDS Forum

Re: IDS 12.10 onaudit configuration

Posted By: Fernando Nunes
Date: Monday, 3 October 2016, at 8:54 p.m.

In Response To: IDS 12.10 onaudit configuration (MOHD FADZIL JUSOH)

Answers inline

On Thu, Sep 29, 2016 at 10:21 AM, MOHD FADZIL JUSOH <fadzil@isianpadu.com>
wrote:

> HI,
>
> I want to enable audit configuration on production database, before that
> need
> some advice/best practices to avoid any degrade performance on my
> production
> database.
>
> 1. When we enable audit, any impact to performance.? if yes, how to
> minimize
> this.
>

There isn't a simple answer to this. I hope you have some programming
knowledge because that will help you understand my answer.
When you activate auditing you define which operations will be udited for
which users. The impact will be directly relted to the number of
occurrences of operations that are to be audited.

Let's think as a programmer, and plase notice I never saw Informix source
code. But the auditing works more or less like this:
When an auditable operation/function is executed it must do this;
1- Is auditing turned on? If yes, GOTO 2. If not continue with operation
2- Does the current session audit mask contain the bit for this operation?
If yes continue to 3. If not continue with operation
3- Do the auditing
4- Operation

Now... Test 1) is always done even if you don't have the auditing turned on.
Test 2) is only done if auditing is turned on. This is an additional very,
very fast test. Negligible impact
Point 3) is what takes time... How many times does it happen? Depends on
your auditing masks

Let's try a more pragmatic approach...

- GRANT/REVOKE operations... Should be audited. Do they happen many times?
Probably not.
- CREATE DROP TABLE. Should be audited. Do they happen many times? Probably
not, unless your application creates a lot of temp tables
- ROW level operations (read row, insert row, update row, delete row).
Should be audited? Maybe... For which users? For which tables? These are
the ones which happen more frequently... without cautious filters on users
and/or tables it may kill the database performance.
- EXECUTE PROCEDURE. Should they be audited? Maybe. Do they happen
frequently? Depends on the application. I have a customer who executes
around 200 procedures per second....

A final note on this. Some people need to audit all the operations from
their DBAs to prevent unauthorized accesses. And yet, they are afraid that
this may "kill" the performance. My point of view is this: If they
shouldn't do the accesses, the operations will not happen, and the
performance impact will not happen. The real question should be: Can they
do their work without doing certain operations, and accessing sensitive
data? It's not up to me to answer.

>
> 2. how to configure audit auto start with database, means when we start
> database with audit function enable. Any parameter on config file need to
> add
> to enable audit?
>

The audit configuration will be stored in the system and within a file
stored in $INFORMIXDIR/etc/aaodir (adtcfg.SERVERNUM)
So after activating it you just nned to start/stop the instance as normal.

>
> 3. Can we customize output file for this audit? example when we allow
> audit to
> record "drop table",(DRTB) we want exclude TEMP table, no need to audit
> temp
> table.
>

We cannot prevent temp table creation/dropping from appearing in the audit
files if we set CRTB and DRTB operations. I believe there was a RFE for
that. Vote for it if you find it important.
We cannot "customize" the audit files.... apart one environment variable
that controls what appears in the client name (can show the client naem
both as sent by the client and as seen by the server)

I'm a bit tired of requesting the SID to be present in the audit files....
Without it, audit is nearly useless for JAVA applications as the client PID
shows up as -1 (because pure AJva has no way to find it's PID). But with a
PID of "-1" for all the operations/connections, we cannot understand the
sequence of actions. There is also an RFE for this.

>
> Please advice.
>
> Thank You
>
>
> ************************************************************
> *******************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

Regards.

--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

--94eb2c08e51882da9f053dff7fe3

Messages In This Thread

• IDS 12.10 onaudit configuration
  MOHD FADZIL JUSOH -- Thursday, 29 September 2016, at 5:21 a.m.
  • Re: IDS 12.10 onaudit configuration
    BENJAMIN THOMPSON -- Thursday, 29 September 2016, at 7:09 a.m.
    • Re: IDS 12.10 onaudit configuration
      MOHD FADZIL JUSOH -- Saturday, 1 October 2016, at 11:15 a.m.
      • Re: IDS 12.10 onaudit configuration
        Alexandre Marini -- Monday, 3 October 2016, at 9:50 p.m.
    • Re: IDS 12.10 onaudit configuration
      Alexandre Marini -- Monday, 3 October 2016, at 11:15 p.m.
  • Re: IDS 12.10 onaudit configuration
    Fernando Nunes -- Monday, 3 October 2016, at 8:54 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.