Informix

 View Only
  • 1.  onaudit: precision of datetime of audited events?

    IBM Champion
    Posted Fri August 23, 2024 02:54 PM

    IDS 12.10.FC14

    SOLARIS 10  1/13

    The onaudit utility creates audit trail files, as documented here: Audit-record format

    The second field is the date and time of the audited event.  I have enabled auditing with onaudit, and observe the audit trail files, and see that all the timestamps recorded in the audit trail files have precision only to the level of second.  For example, the following string was copy-and-pasted from an audit trail file: "2024-08-22 12:30:54.000".

    The documentation ( Creating a table for audit data ) , quoted below, shows how to create a table to store output from the audit trail files.  Note that IBM shows the creation of a table which uses a precision of 1 millisecond for the datetime element:

    The sample CREATE TABLE statement in the following example creates an audit table with the name frag_logs...

    CREATE TABLE frag_logs
    (
        adttag CHAR(4) NOT NULL,
        date_time DATETIME YEAR TO FRACTION(3) NOT NULL,
        hostname VARCHAR(128) NOT NULL,
        pid INTEGER NOT NULL,
        server VARCHAR(128) NOT NULL,
        username VARCHAR(32) NOT NULL,
        errno INTEGER NOT NULL,
        code CHAR(4) NOT NULL,
        dbname VARCHAR(128),
        tabid INTEGER,
        objname VARCHAR(128),
        extra_1 INTEGER,
        partno INTEGER,
        row_num INTEGER,
        login VARCHAR(32),
        flags INTEGER,
        extra_2 VARCHAR(160)
    );
    QUESTION:  How can I get onaudit to produce audit trail files with the event timestamps having 1 ms precision?  I am unable to find anything in the documentation that would indicate a way to do this.
    In short, I would like to have the audit trail files from onaudit provide the times of the events at the 1 ms level of precision.
    Thank you for any comments.
    I am reluctant to burden Tech Support with something that seems like I should be able to determine from the documentation.  But, alas, I am unable to do so.
    DG


    ------------------------------
    David Grove
    ------------------------------


  • 2.  RE: onaudit: precision of datetime of audited events?

    IBM Champion
    Posted Fri August 23, 2024 05:00 PM

    David:

    I'm not sure if this affects the timestamps in the audit modules, but there is an ONCONFIG parameter, USEOSTIME, that improves the resolution of CURRENT from seconds to the maximum resolution of the processor. It defaults to zero (off) mainly because early on Informix mostly ran on XENIX and the gettimeofday() call that enabling this parameter uses was dirt slow in XENIX. In all modern OS's that system call is fast, so there is no longer any reason to not enable it in your ONCONFIG file.

    Art



    ------------------------------
    Art S. Kagel, President and