Alter Security_Audit

Valid in: SQL, ESQL

The Alter Security_Audit statement allows the current security audit log to be switched and for security auditing to be suspended or resumed in the current installation. This statement takes effect immediately and cannot be issued within a multi-statement transaction. It is available in dynamic SQL.

Syntax

The Alter Security_Audit statement has the following format:

[EXEC SQL] ALTER SECURITY_AUDIT [SUSPEND|RESUME|RESTART|STOP] [WITH AUDIT_LOG = 'audit_filename']

• ALTER SECURITY_AUDIT SUSPEND|RESUME

  Allows auditing to be suspended and later resumed. This allows maintenance on security audit logs to take place as required. When auditing is suspended any sessions that attempt to generate security audit records are stalled until auditing is resumed. Auditing is suspended immediately after the audit record logging the alter security_audit statement is written.

  Auditing can only be suspended when it is active, and resumed when it is suspended.

  On installation restart, auditing is resumed automatically.

  To allow the audit system to be resumed, users with maintain_audit privilege can continue to access Ingres even when auditing is suspended. In this case any audit events generated are written to the audit log.

• ALTER SECURITY_AUDIT RESTART

  Restarts auditing.

• ALTER SECURITY_AUDIT STOP

  Stops auditing on request. This statement cannot be used to start security logging for servers that were not started with logging enabled. Auditing can only be stopped when it is active, and restarted when it is stopped.

  Security auditing can be stopped, either by issuing an alter security_audit stop statement, or as the result of an audit system condition such as logfull or on-error.

• ALTER SECURITY_AUDIT WITH AUDIT_LOG = 'audit_filename'

  Sets the current installation security log. The security audit log can be changed whenever auditing is active (that is, when it is not stopped or suspended), or when restarting or resuming auditing. The audit log file specified must actually exist in the Ingres audit configuration.

Embedded Usage

Audit_filename can be specified using a string hostname variable in an embedded Alter Security_Audit statement.

Permissions

Alter Security_Audit requires the maintain_audit privilege and can only be issued while connected to the iidbdb database.

Related Statements

Disable Security_Audit

Enable Security_Audit

Examples: Alter Security_Audit

The following examples allow the current security audit log to be switched and for security auditing to be suspended or resumed in the current installation:

1. Restart security auditing after it has been suspended.

   alter security_audit resume;

2. Restart auditing, switching to a new audit log.

   Windows:

   alter security_audit restart
   with audit_log = 'd:\oping\ingres\files\audit.log'

   UNIX:

   alter security_audit restart
   with audit_log = /install/ingres/files/audit.3

   VMS:

   alter security_audit restart
   with audit_log = disk$7:[ingres.files]audit.3

3. Cause Ingres to log events to the auditlog.7 file.

   alter security_audit
   with audit_log = '/auditdisk/auditlog.7';