Skip Headers

Oracle® Audit Vault Auditor's Guide Release 10.2.3.1 Part Number E13842-02 |
Home | Book List | Contents | Index | Contact Us

Previous | Next
| View PDF

# D IBM DB2 Audit Events

This appendix contains:

- About the IBM DB2 Audit Events

- Account Management Events

- Application Management Events

- Audit Command Events

- Data Access Events

- Exception Events

- Invalid Record Events

- Object Management Events

- Peer Association Events

- Role and Privilege Management Events

- Service and Application Utilization Events

- System Management Events

- Unknown or Uncategorized Events

- User Session Events

## D.1 About the IBM DB2 Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for IBM DB2. The audit events are organized by their respective categories (for example, Account Management). You can use these audit events as follows:

- For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See "Creating an Alert" for more information.

- For custom reports using third-party tools. If you want to create custom reports using other Oracle Database reporting products or third-party tools, refer to the tables in this appendix when you design the reports. See Chapter 4, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.

## D.2 Account Management Events

Account management events track SQL commands that affect user accounts, such as the `UNLOCK ADMIN ACCOUNT` command. The Account Management Report, described in Section 3.4.1, uses these events.

Table D-1 lists the IBM DB2 account management events and event IDs.

Table D-1 IBM DB2 Account Management Events and Event IDs

Event Name | Event ID
--- | ---
`ADD_USER` | `ADD_USER`
`ALTER_USER_ADD_ROLE` | `ALTER_USER_ADD_ROLE`
`ALTER_USER_AUTHENTICATION` | `ALTER_USER_AUTHENTICATION`
`ALTER_USER_DROP_ROLE` | `ALTER_USER_DROP_ROLE`
`DROP_USER` | `DROP_USER`
`SET_SESSION_USER` | `SET_SESSION_USER`

Table D-2 lists the IBM DB2 account management event attributes.

Table D-2 IBM DB2 Account Management Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.3 Application Management Events

Application management events track actions that were performed on the underlying SQL commands of system services and applications, such as the `CREATE RULE` command. The Procedure Management Report, described in Section 3.4.4, uses these events.

Table D-3 lists the IBM DB2 application management events and event IDs.

Table D-3 IBM DB2 Application Management Events and Event IDs

Event Name | Event ID | Comments
--- | --- | ---
`ALTER_OBJECT` | `ALTER_OBJECT` | This event covers the following object types: `CONTEXT` `FUNCTION` `JAVA` `PACKAGE` `TRIGGER` `TRUSTED CONTEXT`
`CREATE_OBJECT` | `CREATE_OBJECT` | This event covers the following object types: `CONTEXT` `FUNCTION` `JAVA` `PACKAGE` `TRIGGER` `TRUSTED CONTEXT`
`DROP_OBJECT` | `DROP_OBJECT` | This event covers the following object types: `CONTEXT` `FUNCTION` `JAVA` `PACKAGE` `TRIGGER` `TRUSTED CONTEXT`

Table D-4 lists the IBM DB2 application management event attributes.

Table D-4 IBM DB2 Application Management Event Attributes

Attribute Name | Data Type
--- | ---
`ASSOCIATED_OBJECT_NAME` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`NEW_OJBECT_NAME` | `VARCHAR2(4000)`
`NEW_OBJECT_OWNER` | `VARCHAR2(4000)`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.4 Audit Command Events

Audit command events track the use of auditing SQL commands on other SQL commands and on database objects. The Audit Command Report, described in Section 3.4.2, uses these events.

Table D-5 lists the IBM DB2 audit command events and event IDs.

Table D-5 IBM DB2 Audit Command Events and Event IDs

Event Name | Event ID
--- | ---
`AUDIT_REMOVE` | `AUDIT_REMOVE`
`AUDIT_REPLACE` | `AUDIT_REPLACE`
`AUDIT_USING` | `AUDIT_USING`
`START` | `START`
`STOP` | `STOP`

Table D-6 lists the IBM DB2 audit command event attributes.

Table D-6 IBM DB2 Audit Command Event Attributes

Attribute Name | Data Type
--- | ---
`AUDIT_OPTION` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.5 Data Access Events

Data access events track audited SQL commands, such as all `SELECT TABLE`, `INSERT TABLE`, or `UPDATE TABLE` commands. The Data Access Report, described in Section 3.3.2, uses these events.

Table D-7 lists the IBM DB2 data access events and event IDs.

Table D-7 IBM DB2 Data Access Events and Event IDs

Event Name | Event ID | Comments
--- | --- | ---
`EXECUTE` | `EXECUTE` | This event covers the following object types: `INSERT` `UPDATE`
`STATEMENT` | `STATEMENT` |

Table D-8 lists the IBM DB2 data access event attributes.

Table D-8 IBM DB2 Data Access Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.6 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Activity Report, described in Section 3.5.1, uses these events. These events do not have any event names or event IDs; they only contain event attributes.

Table D-9 lists the IBM DB2 exception event attributes.

Table D-9 IBM DB2 Exception Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.7 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.5.2, uses these events.

Table D-10 lists IBM DB2 invalid record event attributes.

Table D-10 IBM DB2 Invalid Record Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`ERROR_ID` | `NUMBER`
`ERROR_MESSAGE` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`MODULE_NAME` | `VARCHAR2(4000)`
`ORIGIN_NODE_NUM` | `NUMBER`
`ORIGINAL_CONTEXT1` | `VARCHAR2(4000)`
`ORIGINAL_CONTEXT2` | `VARCHAR2(4000)`
`ORIGINAL_CONTEXT3` | `VARCHAR2(4000)`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SEVERITY` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.8 Object Management Events

Object management events track audited actions performed on database objects, such as `CREATE TABLE` commands. The Object Management Report, described in Section 3.4.3, uses these events.

Table D-11 lists the IBM DB2 object management events and event IDs.

Table D-11 IBM DB2 Object Management Events and Event IDs

Event Name | Event ID | Comments
--- | --- | ---
`ALTER_OJBECT` | `ALTER_OJBECT` | This event covers the following object types: `INDEX` `SEQUENCE` `STORED_PROCEDURE` `TABLE` `VIEW`
`CREATE_OBJECT` | `CREATE_OBJECT` | This event covers the following object types: `INDEX` `SEQUENCE` `STORED_PROCEDURE` `TABLE` `VIEW`
`DROP_OBJECT` | `DROP_OBJECT` | This event covers the following object types: `INDEX` `SEQUENCE` `STORED_PROCEDURE` `TABLE` `VIEW`
`RENAME_OBJECT` | `RENAME_OBJECT` |

Table D-12 lists the IBM DB2 object management event attributes.

Table D-12 IBM DB2 Object Management Event Attributes

Attribute Name | Data Type
--- | ---
`ASSOCIATED_OBJECT_NAME` | `VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER` | `VARCHAR2(4000)`
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`NEW_OBJECT_NAME` | `VARCHAR2(4000)`
`NEW_OBJECT_OWNER` | `VARCHAR2(4000)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.9 Peer Association Events

Peer association events track database link commands. The Distributed Database Report, described in Section 3.3.4, uses these events. These events do not have any event names or event IDs; they only contain event attributes.

Table D-13 lists the IBM DB2 peer association event attributes.

Table D-13 IBM DB2 Peer Association Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.10 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting a user permissions to alter an object. The Role and Privilege Management Report, described in Section 3.4.5, uses these events.

Table D-14 lists the IBM DB2 role and privilege management events and event IDs.

Table D-14 IBM DB2 Role and Privilege Management Events and Event IDs

Event Name | Event ID | Comments
--- | --- | ---
`ALTER_OBJECT` | `ALTER_OBJECT` |
`CHECKING_FUNCTION` | `CHECKING_FUNCTION` |
`CHECKING_OBJECT` | `CHECKING_OBJECT` |
`CREATE_OBJECT` | `CREATE_OBJECT` |
`DROP_OBJECT` | `DROP_OBJECT` |
`GRANT` | `GRANT` | This event covers the `ROLE` object type
`GRANT_DB_AUTHORITIES` | `GRANT_DB_AUTHORITIES` |
`GRANT_DBADM` | `GRANT_DBADM` |
`IMPLICIT_GRANT` | `IMPLICIT_GRANT` |
`IMPLICIT_REVOKE` | `IMPLICIT_REVOKE` |
`REVOKE` | `REVOKE` | This event covers the `ROLE` object type
`REVOKE_DB_AUTHORITIES` | `REVOKE_DB_AUTHORITIES` |
`REVOKE_DBADM` | `REVOKE_DBADM` |
`TRANSFER_OWNERSHIP` | `TRANSFER_OWNERSHIP` |

Table D-15 lists the IBM DB2 role and privilege management event attributes.

Table D-15 IBM DB2 Role and Privilege Management Event Attributes

Attribute Name | Data Type
--- | ---
`ADMIN_OPTION` | `NUMBER`
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`GRANTEE` | `VARCHAR2(4000)`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`OBJECT_PRIVILEGE` | `VARCHAR2(4000)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`ROLE_NAME` | `VARCHAR2(4000)`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`SYSTEM_PRIVILEGE` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.11 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of SQL commands. The Procedure Executions Report, described in Section 3.3.5, uses these events.

Table D-16 lists the IBM DB2 service and application utilization events and event IDs.

Table D-16 IBM DB2 Service and Application Utilization Events and Event IDs

Event Name | Event ID
--- | ---
`EXECUTE` | `EXECUTE`
`EXECUTE_IMMEDIATE` | `EXECUTE_IMMEDIATE`

Table D-17 lists the IBM DB2 service and application utilization event attributes.

Table D-17 IBM DB2 Service and Application Utilization Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.12 System Management Events

System management events track audited system management activity, such as the `CREATE DATABASE` and `DISK INIT` commands. The System Management Report, described in Section 3.4.6, uses these events.

Table D-18 lists the IBM DB2 system management events and event IDs.

Table D-18 IBM System Management Events and Event IDs

Event Name | Event ID
--- | ---
`ACTIVATE_DB` | `ACTIVATE_DB`
`ADD_NODE` | `ADD_NODE`
`ALTER_BUFFERPOOL` | `ALTER_BUFFERPOOL`
`ALTER_DATABASE` | `ALTER_DATABASE`
`ALTER_NODEGROUP` | `ALTER_NODEGROUP`
`ALTER_OBJECT` | `ALTER_OBJECT`
`ALTER_TABLESPACE` | `ALTER_TABLESPACE`
`BACKUP_DB` | `BACKUP_DB`
`BIND` | `BIND`
`CLOSE_HISTORY_FILE` | `CLOSE_HISTORY_FILE`
`CONFIGURE` | `CONFIGURE`
`CREATE_BUFFERPOOL` | `CREATE_BUFFERPOOL`
`CREATE_DATABASE` | `CREATE_DATABASE`
`CREATE_DB_AT_NODE` | `CREATE_DB_AT_NODE`
`CREATE_EVENT_MONITOR` | `CREATE_EVENT_MONITOR`
`CREATE_INSTANCE` | `CREATE_INSTANCE`
`CREATE_NODEGROUP` | `CREATE_NODEGROUP`
`CREATE_OBJECT` | `CREATE_OBJECT`
`CREATE_TABLESPACE` | `CREATE_TABLESPACE`
`DB2AUDIT` | `DB2AUDIT`
`DB2REMOT` | `DB2REMOT`
`DB2SET` | `DB2SET`
`DEACTIVATE_DB` | `DEACTIVATE_DB`
`DELETE_INSTANCE` | `DELETE_INSTANCE`
`DROP_BUFFERPOOL` | `DROP_BUFFERPOOL`
`DROP_DATABASE` | `DROP_DATABASE`
`DROP_EVENT_MONITOR` | `DROP_EVENT_MONITOR`
`DROP_NODEGROUP` | `DROP_NODEGROUP`
`DROP_OBJECT` | `DROP_OBJECT`
`DROP_TABLESPACE` | `DROP_TABLESPACE`
`FETCH_HISTORY_FILE` | `FETCH_HISTORY_FILE`
`FORCE_APPLICATION` | `FORCE_APPLICATION`
`KILLDBM` | `KILLDBM`
`MIGRATE_DB` | `MIGRATE_DB`
`MIGRATE_DB_DIR` | `MIGRATE_DB_DIR`
`MIGRATE_SYSTEM_DIRECTORY` | `MIGRATE_SYSTEM_DIRECTORY`
`OPEN_HISTORY_FILE` | `OPEN_HISTORY_FILE`
`QUIESCE_TABLESPACE` | `QUIESCE_TABLESPACE`
`REBIND` | `REBIND`
`RENAME_TABLESPACE` | `RENAME_TABLESPACE`
`RESET_ADMIN_CFG` | `RESET_ADMIN_CFG`
`RESET_DB_CFG` | `RESET_DB_CFG`
`RESET_DBM_CFG` | `RESET_DBM_CFG`
`RESTORE_DB` | `RESTORE_DB`
`ROLLFORWARD_DB` | `ROLLFORWARD_DB`
`SET_APPL_PRIORITY` | `SET_APPL_PRIORITY`
`SET_TABLESPACE_CONTAINERS` | `SET_TABLESPACE_CONTAINERS`
`START_DB2` | `START_DB2`
`STOP_DB2` | `STOP_DB2`
`UNQUIESCE_TABLESPACE` | `UNQUIESCE_TABLESPACE`
`UPDATE_ADMIN_CFG` | `UPDATE_ADMIN_CFG`
`UPDATE_AUDIT` | `UPDATE_AUDIT`
`UPDATE_DB_CFG` | `UPDATE_DB_CFG`
`UPDATE_DBM_CFG` | `UPDATE_DBM_CFG`

Table D-19 lists the IBM DB2 system management event attributes.

Table D-19 IBM DB2 System Management Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.13 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized. The Uncategorized Activity Report, described in Section 3.5.3, uses these events.

Table D-20 lists the IBM DB2 unknown or uncategorized event and event ID.

Table D-20 IBM DB2 Unknown or Uncategorized Events and Event IDs

Event Name | Event ID
--- | ---
`ALTER_OBJECT` | `ALTER_OBJECT`
`CREATE_OBJECT` | `CREATE_OBJECT`
`DROP_OBJECT` | `DROP_OBJECT`

Table D-21 lists the IBM DB2 unknown or uncategorized event attributes.

Table D-21 IBM DB2 Unknown or Uncategorized Event Attributes

Attribute Name | Data Type
--- | ---
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`

## D.14 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.6, uses these events.

Table D-22 lists the IBM DB2 user session events and event IDs.

Table D-22 IBM DB2 User Session Events and Event IDs

Event Name | Event ID
--- | ---
`ATTACH` | `ATTACH`
`AUTHENTICATE` | `AUTHENTICATE`
`COMMIT` | `COMMIT`
`CONNECT` | `CONNECT`
`CONNECT RESET` | `CONNECT RESET`
`DETACH` | `DETACH`
`ROLLBACK` | `ROLLBACK`
`VALIDATE_USER` | `VALIDATE_USER`

Table D-23 lists the IBM DB2 user session event attributes.

Table D-23 IBM DB2 User Session Event Attributes

Attribute Name | Data Type
--- | ---
`AUTHENTICATION_METHOD` | `VARCHAR2(255)`
`CONTEXTID` | `VARCHAR2(4000)`
`COORDINATOR_NODE_NUM` | `NUMBER`
`ENDUSER` | `VARCHAR2(4000)`
`EVENT_STATUS` | `VARCHAR2(30)`
`EVENT_TIME` | `TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP` | `VARCHAR2(255)`
`HOST_NAME` | `VARCHAR2(255)`
`HOST_TERMINAL` | `VARCHAR2(255)`
`ORIGIN_NODE_NUM` | `NUMBER`
`OSUSER_NAME` | `VARCHAR2(4000)`
`PACKAGE_INFO_STR` | `VARCHAR2`
`PARENT_CONTEXTID` | `VARCHAR2(4000)`
`PRIVILEGES_USED` | `VARCHAR2(4000)`
`PROCESS#` | `NUMBER`
`SOURCE_EVENTID` | `VARCHAR2(255)`
`SUB_CONTEXTID` | `VARCHAR2(4000)`
`TARGET_OBJECT` | `VARCHAR2(4000)`
`TARGET_OWNER` | `VARCHAR2(4000)`
`THREAD#` | `NUMBER`
`TOOLS_USED` | `VARCHAR2(4000)`
`TRUSTED_CONTEXT_STR` | `VARCHAR2`
`USERNAME` | `VARCHAR2(4000)`