DB2X-00-011500 - DB2 must generate audit records when unsuccessful logons or connection attempts occur

Information

For completeness of forensic analysis, it is necessary to track failed attempts to log on to the DBMS. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.

Solution

Run the following command to define an audit policy with the needed subset using the CREATE AUDIT POLICY SQL statement:
DB2> CREATE AUDIT POLICY <DB audit policy name>
CATEGORIES VALIDATE STATUS BOTH, CONTEXT STATUS BOTH
ERROR TYPE AUDIT

To modify an existing audit policy, replace 'CREATE' with 'ALTER' in the preceding statement. Only the categories explicitly named in the statement will be affected. In this case, the changes take effect immediately.

If CREATE was used above, run the following command to apply the policy created above to the database:
DB2> AUDIT DATABASE USING POLICY <DB audit policy name>

Item Details

Audit Name: DISA STIG IBM DB2 v10.5 LUW v2r1 Database

Category: AUDIT AND ACCOUNTABILITY

Plugin: IBM_DB2DB

Control ID: 0c408467ef12fd4f03c4d8e13d7737b4b2ce21380a0f1ba3842de81d2a10fbd4

Detections

Analytics

DB2X-00-011500 - DB2 must generate audit records when unsuccessful logons or connection attempts occur

Information

Solution

See Also

Item Details