Informix

 View Only
Expand all | Collapse all

ALTER TABLE removes it from audit trail

  • 1.  ALTER TABLE removes it from audit trail

    Posted Mon December 12, 2022 09:37 AM

    Hi.

    Ran into a strange situation.
    ALTER TABLE xxx ADD AUDIT;
    Do a dbschema and the  WITH AUDIT  clause is present. 
    ALTER TABLE xxx ADD (c int); -- or whatever
    Do a dbschema and the WITH AUDIT clause is gone.

    Surely a bug? Newest version I tried this with is 14.10.FC7W1

    Best regards,
    -S



    ------------------------------
    Snorri Bergmann
    ------------------------------

    #Informix


  • 2.  RE: ALTER TABLE removes it from audit trail

    Posted Mon December 12, 2022 09:58 AM
    This is the way it has been for years.  When you alter a table previously defined as "with audit", the auditing of that table disappears.  When you alter the table, you need to include ", add audit" again.

    Whether a bug or a "feature" is debatable.  It's certainly confusing as you would expect that the auditing would be retained after doing a simple alter.  Maybe a feature request?




    ------------------------------
    Mike Walker
    xDB Systems, Inc
    www.xdbsystems.com
    ------------------------------

    Original Message


  • 3.  RE: ALTER TABLE removes it from audit trail

    Posted Mon December 12, 2022 03:39 PM
    Thanks Mike.

    This is very confusing to say the least. Do you know if this behavior is documented somewhere?

    Best regs,
    -Snorri

    ------------------------------
    Snorri Bergmann
    ------------------------------

    Original Message


  • 4.  RE: ALTER TABLE removes it from audit trail

    Posted Tue December 13, 2022 08:13 AM
    I do not know for sure if this behavior is documented, but I don't think so.  I took a quick look at the documentation and could not find any mention of the row-level auditing being dropped when the table is altered.

    I found out by running into this situation myself.

    I touched on this in a presentation I did on Informix auditing.  See slide 45 here:  https://advancedatatools.com/Downloads/InformixBestPractices-Auditing-MikeWalker.pdf 
    I recommend there that you perform checks to make sure tables that you have set up for auditing are still being audited, and that it hasn't been dropped because somebody altered the table.






    ------------------------------
    Mike Walker
    xDB Systems, Inc
    www.xdbsystems.com
    ------------------------------

    Original Message


  • 5.  RE: ALTER TABLE removes it from audit trail

    Posted Thu February 23, 2023 06:07 AM

    FYI: looking like next fixpack (14.10.xC10) is going to have this fixed.



    ------------------------------
    Andreas Legner
    ------------------------------

    Original Message


  • 6.  RE: ALTER TABLE removes it from audit trail

    Posted Thu February 23, 2023 06:22 AM

    Thanks Andreas.

    Best regards,

    -Snorri



    ------------------------------
    Snorri Bergmann
    ------------------------------

    Original Message


  • 7.  RE: ALTER TABLE removes it from audit trail

    Posted Thu February 23, 2023 06:36 AM

    BTW: Any idea when xC10 will be released? 



    ------------------------------
    Snorri Bergmann
    ------------------------------

    Original Message


  • 8.  RE: ALTER TABLE removes it from audit trail

    Posted Thu December 28, 2023 02:39 AM

    Hi.

    I did a test with 14.10.FC10W1 and this is still not fixed https://justdaveinfo.wordpress.com/2023/12/28/informix-auditing-and-alter-table/

    Does this have an APAR yet? Or a fix date?

    Regards,
    David.



    ------------------------------
    David Williams
    ------------------------------

    Original Message


  • 9.  RE: ALTER TABLE removes it from audit trail

    Posted Thu January 04, 2024 07:08 AM

    Hi David,

    I can report that this is fixed since quite a while, and an internal drop of 14.10.xC11 indeed doesn't reproduce it any more (since not reported via a support case, it didn't get an APAR).

    (14.10.xC10W1 mainly meant to address a couple of security issues.)

    BR,

     Andreas



    ------------------------------
    Andreas Legner
    ------------------------------

    Original Message