D IBM DB2 Audit Events

This appendix contains:

About the IBM DB2 Audit Events
Account Management Events
Application Management Events
Audit Command Events
Data Access Events
Exception Events
Invalid Record Events
Object Management Events
Peer Association Events
Role and Privilege Management Events
Service and Application Utilization Events
System Management Events
Unknown or Uncategorized Events
User Session Events

D.1 About the IBM DB2 Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for IBM DB2. The audit events are organized by their respective categories (for example, Account Management). You can use these audit events as follows:

For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See "Creating an Alert" for more information.
For custom reports using third-party tools. If you want to create custom reports using other Oracle Database reporting products or third-party tools, refer to the tables in this appendix when you design the reports. See Chapter 4, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.

D.2 Account Management Events

Account management events track SQL commands that affect user accounts, such as the UNLOCK ADMIN ACCOUNT command. The Account Management Report, described in Section 3.4.1, uses these events.

Table D-1 lists the IBM DB2 account management events and event IDs.

Table D-1 IBM DB2 Account Management Events and Event IDs

Event Name	Event ID
`ADD_USER`	`ADD_USER`
`ALTER_USER_ADD_ROLE`	`ALTER_USER_ADD_ROLE`
`ALTER_USER_AUTHENTICATION`	`ALTER_USER_AUTHENTICATION`
`ALTER_USER_DROP_ROLE`	`ALTER_USER_DROP_ROLE`
`DROP_USER`	`DROP_USER`
`SET_SESSION_USER`	`SET_SESSION_USER`

Table D-2 lists the IBM DB2 account management event attributes.

Table D-2 IBM DB2 Account Management Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.3 Application Management Events

Application management events track actions that were performed on the underlying SQL commands of system services and applications, such as the CREATE RULE command. The Procedure Management Report, described in Section 3.4.4, uses these events.

Table D-3 lists the IBM DB2 application management events and event IDs.

Table D-3 IBM DB2 Application Management Events and Event IDs

Event Name Event ID Comments

Event Name	Event ID	Comments
`ALTER_OBJECT`	`ALTER_OBJECT`	This event covers the following object types: `CONTEXT` `FUNCTION` `JAVA` `PACKAGE` `TRIGGER` `TRUSTED CONTEXT`
`CREATE_OBJECT`	`CREATE_OBJECT`	This event covers the following object types: `CONTEXT` `FUNCTION` `JAVA` `PACKAGE` `TRIGGER` `TRUSTED CONTEXT`
`DROP_OBJECT`	`DROP_OBJECT`	This event covers the following object types: `CONTEXT` `FUNCTION` `JAVA` `PACKAGE` `TRIGGER` `TRUSTED CONTEXT`

ALTER_OBJECT

This event covers the following object types:

CONTEXT
FUNCTION
JAVA
PACKAGE
TRIGGER
TRUSTED CONTEXT

CREATE_OBJECT

This event covers the following object types:

CONTEXT
FUNCTION
JAVA
PACKAGE
TRIGGER
TRUSTED CONTEXT

DROP_OBJECT

This event covers the following object types:

CONTEXT
FUNCTION
JAVA
PACKAGE
TRIGGER
TRUSTED CONTEXT

Table D-4 lists the IBM DB2 application management event attributes.

Table D-4 IBM DB2 Application Management Event Attributes

Attribute Name	Data Type
`ASSOCIATED_OBJECT_NAME`	`VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`NEW_OJBECT_NAME`	`VARCHAR2(4000)`
`NEW_OBJECT_OWNER`	`VARCHAR2(4000)`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.4 Audit Command Events

Audit command events track the use of auditing SQL commands on other SQL commands and on database objects. The Audit Command Report, described in Section 3.4.2, uses these events.

Table D-5 lists the IBM DB2 audit command events and event IDs.

Table D-5 IBM DB2 Audit Command Events and Event IDs

Event Name	Event ID
`AUDIT_REMOVE`	`AUDIT_REMOVE`
`AUDIT_REPLACE`	`AUDIT_REPLACE`
`AUDIT_USING`	`AUDIT_USING`
`START`	`START`
`STOP`	`STOP`

Table D-6 lists the IBM DB2 audit command event attributes.

Table D-6 IBM DB2 Audit Command Event Attributes

Attribute Name	Data Type
`AUDIT_OPTION`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.5 Data Access Events

Data access events track audited SQL commands, such as all SELECT TABLE, INSERT TABLE, or UPDATE TABLE commands. The Data Access Report, described in Section 3.3.2, uses these events.

Table D-7 lists the IBM DB2 data access events and event IDs.

Table D-7 IBM DB2 Data Access Events and Event IDs

Event Name Event ID Comments

Event Name	Event ID	Comments
`EXECUTE`	`EXECUTE`	This event covers the following object types: `INSERT` `UPDATE`
`STATEMENT`	`STATEMENT`

EXECUTE

This event covers the following object types:

INSERT
UPDATE

STATEMENT

Table D-8 lists the IBM DB2 data access event attributes.

Table D-8 IBM DB2 Data Access Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.6 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Activity Report, described in Section 3.5.1, uses these events. These events do not have any event names or event IDs; they only contain event attributes.

Table D-9 lists the IBM DB2 exception event attributes.

Table D-9 IBM DB2 Exception Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.7 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.5.2, uses these events.

Table D-10 lists IBM DB2 invalid record event attributes.

Table D-10 IBM DB2 Invalid Record Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`ERROR_ID`	`NUMBER`
`ERROR_MESSAGE`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`MODULE_NAME`	`VARCHAR2(4000)`
`ORIGIN_NODE_NUM`	`NUMBER`
`ORIGINAL_CONTEXT1`	`VARCHAR2(4000)`
`ORIGINAL_CONTEXT2`	`VARCHAR2(4000)`
`ORIGINAL_CONTEXT3`	`VARCHAR2(4000)`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SEVERITY`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.8 Object Management Events

Object management events track audited actions performed on database objects, such as CREATE TABLE commands. The Object Management Report, described in Section 3.4.3, uses these events.

Table D-11 lists the IBM DB2 object management events and event IDs.

Table D-11 IBM DB2 Object Management Events and Event IDs

Event Name	Event ID	Comments
`ALTER_OJBECT`	`ALTER_OJBECT`	This event covers the following object types: `INDEX` `SEQUENCE` `STORED_PROCEDURE` `TABLE` `VIEW`
`CREATE_OBJECT`	`CREATE_OBJECT`	This event covers the following object types: `INDEX` `SEQUENCE` `STORED_PROCEDURE` `TABLE` `VIEW`
`DROP_OBJECT`	`DROP_OBJECT`	This event covers the following object types: `INDEX` `SEQUENCE` `STORED_PROCEDURE` `TABLE` `VIEW`
`RENAME_OBJECT`	`RENAME_OBJECT`

Table D-12 lists the IBM DB2 object management event attributes.

Table D-12 IBM DB2 Object Management Event Attributes

Attribute Name	Data Type
`ASSOCIATED_OBJECT_NAME`	`VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`NEW_OBJECT_NAME`	`VARCHAR2(4000)`
`NEW_OBJECT_OWNER`	`VARCHAR2(4000)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.9 Peer Association Events

Peer association events track database link commands. The Distributed Database Report, described in Section 3.3.4, uses these events. These events do not have any event names or event IDs; they only contain event attributes.

Table D-13 lists the IBM DB2 peer association event attributes.

Table D-13 IBM DB2 Peer Association Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.10 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting a user permissions to alter an object. The Role and Privilege Management Report, described in Section 3.4.5, uses these events.

Table D-14 lists the IBM DB2 role and privilege management events and event IDs.

Table D-14 IBM DB2 Role and Privilege Management Events and Event IDs

Event Name	Event ID	Comments
`ALTER_OBJECT`	`ALTER_OBJECT`
`CHECKING_FUNCTION`	`CHECKING_FUNCTION`
`CHECKING_OBJECT`	`CHECKING_OBJECT`
`CREATE_OBJECT`	`CREATE_OBJECT`
`DROP_OBJECT`	`DROP_OBJECT`
`GRANT`	`GRANT`	This event covers the `ROLE` object type
`GRANT_DB_AUTHORITIES`	`GRANT_DB_AUTHORITIES`
`GRANT_DBADM`	`GRANT_DBADM`
`IMPLICIT_GRANT`	`IMPLICIT_GRANT`
`IMPLICIT_REVOKE`	`IMPLICIT_REVOKE`
`REVOKE`	`REVOKE`	This event covers the `ROLE` object type
`REVOKE_DB_AUTHORITIES`	`REVOKE_DB_AUTHORITIES`
`REVOKE_DBADM`	`REVOKE_DBADM`
`TRANSFER_OWNERSHIP`	`TRANSFER_OWNERSHIP`

Table D-15 lists the IBM DB2 role and privilege management event attributes.

Table D-15 IBM DB2 Role and Privilege Management Event Attributes

Attribute Name	Data Type
`ADMIN_OPTION`	`NUMBER`
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`GRANTEE`	`VARCHAR2(4000)`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`OBJECT_PRIVILEGE`	`VARCHAR2(4000)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`ROLE_NAME`	`VARCHAR2(4000)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`SYSTEM_PRIVILEGE`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.11 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of SQL commands. The Procedure Executions Report, described in Section 3.3.5, uses these events.

Table D-16 lists the IBM DB2 service and application utilization events and event IDs.

Table D-16 IBM DB2 Service and Application Utilization Events and Event IDs

Event Name	Event ID
`EXECUTE`	`EXECUTE`
`EXECUTE_IMMEDIATE`	`EXECUTE_IMMEDIATE`

Table D-17 lists the IBM DB2 service and application utilization event attributes.

Table D-17 IBM DB2 Service and Application Utilization Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.12 System Management Events

System management events track audited system management activity, such as the CREATE DATABASE and DISK INIT commands. The System Management Report, described in Section 3.4.6, uses these events.

Table D-18 lists the IBM DB2 system management events and event IDs.

Table D-18 IBM System Management Events and Event IDs

Event Name	Event ID
`ACTIVATE_DB`	`ACTIVATE_DB`
`ADD_NODE`	`ADD_NODE`
`ALTER_BUFFERPOOL`	`ALTER_BUFFERPOOL`
`ALTER_DATABASE`	`ALTER_DATABASE`
`ALTER_NODEGROUP`	`ALTER_NODEGROUP`
`ALTER_OBJECT`	`ALTER_OBJECT`
`ALTER_TABLESPACE`	`ALTER_TABLESPACE`
`BACKUP_DB`	`BACKUP_DB`
`BIND`	`BIND`
`CLOSE_HISTORY_FILE`	`CLOSE_HISTORY_FILE`
`CONFIGURE`	`CONFIGURE`
`CREATE_BUFFERPOOL`	`CREATE_BUFFERPOOL`
`CREATE_DATABASE`	`CREATE_DATABASE`
`CREATE_DB_AT_NODE`	`CREATE_DB_AT_NODE`
`CREATE_EVENT_MONITOR`	`CREATE_EVENT_MONITOR`
`CREATE_INSTANCE`	`CREATE_INSTANCE`
`CREATE_NODEGROUP`	`CREATE_NODEGROUP`
`CREATE_OBJECT`	`CREATE_OBJECT`
`CREATE_TABLESPACE`	`CREATE_TABLESPACE`
`DB2AUDIT`	`DB2AUDIT`
`DB2REMOT`	`DB2REMOT`
`DB2SET`	`DB2SET`
`DEACTIVATE_DB`	`DEACTIVATE_DB`
`DELETE_INSTANCE`	`DELETE_INSTANCE`
`DROP_BUFFERPOOL`	`DROP_BUFFERPOOL`
`DROP_DATABASE`	`DROP_DATABASE`
`DROP_EVENT_MONITOR`	`DROP_EVENT_MONITOR`
`DROP_NODEGROUP`	`DROP_NODEGROUP`
`DROP_OBJECT`	`DROP_OBJECT`
`DROP_TABLESPACE`	`DROP_TABLESPACE`
`FETCH_HISTORY_FILE`	`FETCH_HISTORY_FILE`
`FORCE_APPLICATION`	`FORCE_APPLICATION`
`KILLDBM`	`KILLDBM`
`MIGRATE_DB`	`MIGRATE_DB`
`MIGRATE_DB_DIR`	`MIGRATE_DB_DIR`
`MIGRATE_SYSTEM_DIRECTORY`	`MIGRATE_SYSTEM_DIRECTORY`
`OPEN_HISTORY_FILE`	`OPEN_HISTORY_FILE`
`QUIESCE_TABLESPACE`	`QUIESCE_TABLESPACE`
`REBIND`	`REBIND`
`RENAME_TABLESPACE`	`RENAME_TABLESPACE`
`RESET_ADMIN_CFG`	`RESET_ADMIN_CFG`
`RESET_DB_CFG`	`RESET_DB_CFG`
`RESET_DBM_CFG`	`RESET_DBM_CFG`
`RESTORE_DB`	`RESTORE_DB`
`ROLLFORWARD_DB`	`ROLLFORWARD_DB`
`SET_APPL_PRIORITY`	`SET_APPL_PRIORITY`
`SET_TABLESPACE_CONTAINERS`	`SET_TABLESPACE_CONTAINERS`
`START_DB2`	`START_DB2`
`STOP_DB2`	`STOP_DB2`
`UNQUIESCE_TABLESPACE`	`UNQUIESCE_TABLESPACE`
`UPDATE_ADMIN_CFG`	`UPDATE_ADMIN_CFG`
`UPDATE_AUDIT`	`UPDATE_AUDIT`
`UPDATE_DB_CFG`	`UPDATE_DB_CFG`
`UPDATE_DBM_CFG`	`UPDATE_DBM_CFG`

Table D-19 lists the IBM DB2 system management event attributes.

Table D-19 IBM DB2 System Management Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.13 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized. The Uncategorized Activity Report, described in Section 3.5.3, uses these events.

Table D-20 lists the IBM DB2 unknown or uncategorized event and event ID.

Table D-20 IBM DB2 Unknown or Uncategorized Events and Event IDs

Event Name	Event ID
`ALTER_OBJECT`	`ALTER_OBJECT`
`CREATE_OBJECT`	`CREATE_OBJECT`
`DROP_OBJECT`	`DROP_OBJECT`

Table D-21 lists the IBM DB2 unknown or uncategorized event attributes.

Table D-21 IBM DB2 Unknown or Uncategorized Event Attributes

Attribute Name	Data Type
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`

D.14 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.6, uses these events.

Table D-22 lists the IBM DB2 user session events and event IDs.

Table D-22 IBM DB2 User Session Events and Event IDs

Event Name	Event ID
`ATTACH`	`ATTACH`
`AUTHENTICATE`	`AUTHENTICATE`
`COMMIT`	`COMMIT`
`CONNECT`	`CONNECT`
`CONNECT RESET`	`CONNECT RESET`
`DETACH`	`DETACH`
`ROLLBACK`	`ROLLBACK`
`VALIDATE_USER`	`VALIDATE_USER`

Table D-23 lists the IBM DB2 user session event attributes.

Table D-23 IBM DB2 User Session Event Attributes

Attribute Name	Data Type
`AUTHENTICATION_METHOD`	`VARCHAR2(255)`
`CONTEXTID`	`VARCHAR2(4000)`
`COORDINATOR_NODE_NUM`	`NUMBER`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`ORIGIN_NODE_NUM`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PACKAGE_INFO_STR`	`VARCHAR2`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR`	`VARCHAR2`
`USERNAME`	`VARCHAR2(4000)`