These days there is a lot of talk about audit, specifically regarding Db2 on z/OS. So, in this newsletter, I wish to run through four different ways that you can “Get Audit Done”.
As well as simply getting it done, I will also run through the four different ways that you can process the gathered data.
Four ways to get a Db2 z/OS Audit done
1- First up
First option is the simplest, cheapest and quickest:
Do nothing.
Whether or not this will help your company is a non-trivial question of course!
Naturally this is an absolute No No.
2- Then we have
Next option is relatively simple and cheap, but requires a bit of work:
Write it all yourself but based on existing data that some other process already extracts for you, (SMF for example).
If you happen to have the skills for extracting the required audit data from existing data that is being collected anyway, then this might well be the best method if you are really strapped for resources.
3- Getting there
Then we have not so simple, still cheap, but a ton of work:
Write it all yourself and add all the IFCIDs you actually need to audit your system as well as capturing all the SQL.
This needs a serious amount of skills to get and keep up with the agile world of Db2. You will also need to take care of the amount of data that you will be collecting.
However, the auditor will be happy as you have everything they could ask for.
4- Aha! The only true way
Last option is simple, not so cheap but very quick:
Third Party software that does it all for you.
This is my preferred solution, especially as we just happen to sell one (WorkLoadExpert Audit).
This is actually the only real way to go. You probably don’t have the time to keep all these things up-to-date and running correctly.
Data Collected – Now what?
So, you have chosen one of these ways to gather the data. Now you must evaluate what you got. Here again we have four separate ways to go forward:
First up
There it is!
Do nothing. Just point at the datasets, print outs, database objects and say “It is all in there…”
This is not really a solution and any auditor worth his, or her, salt would quite rightly be extremely upset!
Then we have
A whole bunch of pre-written SQLs.
SPUFI is ok, but much better would be to see these in a GUI where graphical viewing is built in and saving and sharing results is much easier.
This is not bad, but still a manual “island” process. Just Db2 and nothing else plus it must be triggered by humans.
Getting there
A whole bunch of pre-written and custom SQLs.
This time, all run in Batch and the results are emailed to the auditor directly. These emails can “just sit there” until the auditor checks the results. Naturally, if anything is found, then the underlying data must still be there for a detailed analysis.
Better, as it is getting automatic but still not really “round”, as it is still Db2 in isolation…
Aha! The only true way
Use of LEEF or SYSLOGGER-style formats to export all audit data.
The data is then in a data-lake where SPLUNK, QRADAR et al can happily slice and dice their way through the data.
This is the best way!
You also get an extra bonus point for *removing* the data from the mainframe. As auditors *love* a single point of control, this is the only real way forward. It also pushes the Db2 data into the world of other data that auditors use and require.
Db2 Audit with “GIVE&TAKE” :
Software Engineering GmbH and SEGUS Inc are launching a new free Give&Take which this time is the Audit support from WorkLoadExpert.
If you would like to take part, then please just fire off an email to db2support@segus.com telling us who you are and which firm you work for and we will get in touch!
Give and Take
By the way, it is called “Give&Take” because :
- we Give you the software, for free, to run for a trial period, and
- we would like to Take away what you think, feel, and find about the software after the trial period.
More about Give&Take
TTFN,
Roy Boxwell