28
Module 8: Access and Query Logging After completing this module, you wil l be able to: Describe how the BEGIN/END LOGGING statements capture information about user access to T eradata. Describe how to set up user access logging. Use system views to gather information about data access. Identify the reasons for using the Database Query Log. Identify the tables and views that make up the DBQL facility.

B408 AccLog

Embed Size (px)

Citation preview

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 1/28

Module 8: Access and Query Logging

After completing this module, you will be able to:

Describe how the BEGIN/END LOGGING statementscapture information about user access to Teradata.

Describe how to set up user access logging.

Use system views to gather information about dataaccess.

Identify the reasons for using the Database Query Log.

Identify the tables and views that make up the DBQLfacility.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 2/28

Access and Query Logging

There are two logging facilities available to the database and/or securityadministrator.

• Access Logging Facility

 – Used for access and security audit analysis.

 – May be used to monitor data access requests (via access rights

checks) and log entries for requests that are granted and/or denied.

• Query Logging Facility (DBQL) 

 – Used for query activity and workload analysis.

 – Can be used to track processing behavior and/or capture detailed

information about the queries that are running on a system. – Workloads can be utilized with Teradata Analyst tools such as

Teradata Index Wizard.

 – New facility available with V2R5.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 3/28

Access Logging

An administrator can ...

 – use the Access Logging facility to monitor data access requests and logentries for requests that are granted and/or denied.

 – optionally capture the SQL text along with the access right check.

The following statements are used to specify objects and/or SQL requests tomonitor for specific or all users.

 – BEGIN LOGGING statement 

• Starts the monitoring of data access requests by Teradata.

 –END LOGGING statement• Ends the monitoring of data access requests by Teradata.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 4/28

Objects used in Access Logging

Users who are granted EXECUTE permission on the following macro can use

the BEGIN LOGGING and END LOGGING statements.

DBC.AccLogRule

DD/D MacroExample:

GRANT EXECUTE ON DBC.AccLogRule TO SecAdmin;

This allows "SecAdmin" to execute the BEGINLOGGING and END LOGGING statements.

Execution of BEGIN LOGGING or END LOGGING statements causes rows (representing the rules) to beadded or updated in … 

To view the rules in this table, SELECT from this view.

Based on the rules, access of specified objects or SQLstatements cause entries to be placed in … 

To view the rules in this table, SELECT from this view.

DBC.AccLogRuleTblDD/D Table

DBC.AccLogRules

DD/D View

DBC.AccLogTbl

(can potentially become large)

DD/D Table

DBC.AccessLog

DD/D View

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 5/28

BEGIN LOGGING Statement

BEGIN LOGGING ON A

DENIALS WITH TEXT FIRST

LAST

FIRST AND LAST

EACH

A ALL ;

, , ON DATABASE dbname  

operation  BY username  USER username GRANT TABLE name 

VIEW dbname .

MACRO

PROCEDURE

Operat ion  Any function for which an access right can be granted (e.g., CREATE,

USER, MACRO, GRANT, etc.).BY  username implies all users, if not specified.

ON  object-name implies all entities, if not specified. Valid object-names are:

DATABASE databasename USER username

TABLE tablename VIEW viewname

MACRO macroname PROCEDURE procedurename

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 6/28

END LOGGING Statement

Operat ion  Any function for which an access right can be granted (e.g., CREATE,

USER, MACRO, GRANT, etc.).BY  username implies all users, if not specified.

ON  object-name implies all entities, if not specified. Valid object-names are:

DATABASE databasename USER username

TABLE tablename VIEW viewname

MACRO macroname PROCEDURE procedurename

END LOGGING ON A

DENIALS WITH TEXT

A ALL ;

, , ON DATABASE dbname  

operation  BY username  USER username 

GRANT TABLE name 

VIEW dbname .MACRO

PROCEDURE

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 7/28

Setting Up Access Logging

STEP 1 Install Access Logging on the system:

1. Run the DIP script DIPACC to install the DBC.AccLogRule macro insystem user DBC.

2. Restart the database to activate the code.

STEP 2 Create and empower a security administrator:

CREATE USER SecAdmin AS Password = secpasswd, PERM = 0, SPOOL = 200e6 ;GRANT EXECUTE ON DBC.AccLogRule TO SecAdmin ;GRANT EXECUTE ON DBC.LogonRule TO SecAdmin ; 

STEP 3 Define access logging rules. Examples:

1. Log all attempts to access security macros.

2. Log all denied attempts to access DBC User.3. Log any CREATE or DROP USER/DATABASE or GRANT commands.

BEGIN LOGGING WITH TEXT ON EACH ALLON MACRO DBC.LogonRule,

MACRO DBC.AccLogRule;

BEGIN LOGGING DENIALS WITH TEXT ON EACH ALL

ON USER DBC;BEGIN LOGGING WITH TEXT ON EACH DATABASE, USER, GRANT;

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 8/28

Access Log Views

DBC.AccLogRules Contains current logging rules generated by BEGIN

and END LOGGING statements.

DBC.AccessLog Contains log entries collected as a result of applying

access log rules.

Dictionary Tables Accessed:

• DBC.AccLogRuleTbl

• DBC.AccLogTbl

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 9/28

DBC.AccLogRules View

Returns information about current access logging rules.

SELECT UserName (CHAR (6)) AS "User//Name",DatabaseName (CHAR (6)) AS "Dbase//Name",TVMName (CHAR (10)) AS "TVM//Name",AcrCreateDatabase, AcrCreateUser, AcrDropDatabase

,AcrDropUser, AcrGrant, AcrSelect, AcrExecuteFROM DBC.AccLogRules;

Example Results:

ACR Columns are positional: 

Position #1 = How often to logrequests (F, L, B, E, blank = First,Last, Both, Each, None)

Position #2 = How often to logdenials (F, L, B, E, blank = First,Last, Both, Each, None)

Position #3 = How often to save text(+ All entries, - Denials, = AllSpecified)

DBC.AccLogRules

UserName DatabaseName TVMName AcrCheckpoint (CPT)AcrCreateDatabase (CDB) AcrCreateMacro (CMC) AcrCreateTable (CTB) AcrCreateUser (CUS)AcrCreateProc (CSP) AcrCreateView (CVW) AcrDelete (DEL) AcrDropDatabase (DDB)AcrDropMacro (DMC) AcrDropTable (DTB) AcrDropUser (DUS) AcrDropView (DVW)AcrDropProc (DSP) AcrDump (DMP) AcrExecute (EXE) AcrExecProc (ESP)AcrGrant (GRT) AcrIndex (IDX) AcrInsert (INS) AcrReference (REF)

AcrRestore (RST) AcrSelect (SEL) AcrUpdate (UPD) AcrCreateTrigger (CTG)AcrDropTrigger (DTG) CreatorName CreateTimeStamp

User Dbase TVMName Name Name CDB CUS DDB DUS GRT SEL EXE

All All All E + E + E + E + E +All DBC LogonRule E + E +

All DBC All E - E - E - E - E - E - E -All DBC AccLogRule E + E +

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 10/28

BEGIN LOGGING – Example

BEGIN LOGGING DENIALS  WITH TEXT ON EACH SELECT ON TABLE PD.Employee;

BEGIN LOGGING WITH TEXT ON FIRST INSERT ON TABLE PD.Employee;BEGIN LOGGING WITH TEXT ON FIRST AND LAST DELETE ON TABLE PD.Employee;

BEGIN LOGGING WITH TEXT ON FIRST UPDATE ON TABLE PD.Employee;

BEGIN LOGGING DENIALS WITH TEXT ON LAST UPDATE ON TABLE PD.Employee;

SELECT UserName (CHAR (6)) AS "User//Name",DatabaseName (CHAR (6)) AS "Dbase//Name"

,TVMName (CHAR (10)) AS "TVM//Name",AcrSelect, AcrInsert, AcrDelete, AcrUpdate

FROM DBC.AccLogRules WHERE DatabaseName = 'PD';

1

23

4

User Dbase TVMName Name Name SEL INS DEL UPD

All PD Employee E- F + B + FL=

1 2 3 4

Position #1 = How often to log requests (F, L, B, E, blank = First, Last, Both, Each, None)

Position #2 = How often to log denials (F, L, B, E, blank = First, Last, Both, Each, None)

Position #3 = How often to save text (+ All entries, - Denials, = All Specified)

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 11/28

DBC.AccessLog View

Displays entries made to DBC.AccLogTbl.

DBC.AccessLog 

LogDate LogTime LogonDate LogonTimeLogicalHostID IFPNo SessionNo UserNameAccountName OwnerName AccessType FrequencyEventCount Result DatabaseName TVMNameColumnName StatementType StatementText

Access Type The same codes are used that indicate an access right.

Frequency F, L, B, E = First, Last, Both or Each.

To delete entries in the DBC.AccLogTbl, use the DBC.DeleteAccessLog[X] view.

• DELETE FROM DBC.DeleteAccessLog;

 – Deletes entries older than 30 days.

• DELETE FROM DBC.DeleteAccessLog

WHERE LOGDATE < (CURRENT_DATE – 90);

 – Deletes entries older than 90 days.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 12/28

DBC.AccessLog View – Example

SELECT LogTime,UserName (CHAR (10)) AS "User//Name",AccessType AS "Access//Type",Frequency AS "Log//Freq",Result AS "Granted//Denied",StatementText AS "Statement//Text"

FROM DBC.AccessLog

WHERE LogDate = CURRENT_DATEORDER BY LogDate, LogTime ;

ExampleResults:

Example:List all of the entriesin the Access Logtable for the currentdate.

LogTime User Access Log Granted StatementName Type Freq Denied Text

09:04:25 TFACT01 S E D SELECT * FROM PD.Empl...09:10:17 SYSDBA I F G INSERT INTO PD.Employe ...09:12:22 SYSDBA D f G DEL FROM PD.Employee ...09:12:31 SYSDBA D l G DEL FROM PD.Employee ...09:15:54 SYSDBA U F G UPDATE PD.Employee SE ...09:17:04 TFACT01 U f D UPDATE PD.Employee SE ...09:32:50 TFACT01 U l D UPDATE PD.Employee SE ...

Note: The facing page contains the SQL that generated this report.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 13/28

END LOGGING – Example

Previously, these rules were created for logging on PD.Employee table.

BEGIN LOGGING DENIALS  WITH TEXT ON EACH SELECT ON TABLE PD.Employee;

BEGIN LOGGING WITH TEXT ON FIRST INSERT ON TABLE PD.Employee;

BEGIN LOGGING WITH TEXT ON FIRST AND LAST DELETE ON TABLE PD.Employee;

BEGIN LOGGING WITH TEXT ON FIRST UPDATE ON TABLE PD.Employee;

BEGIN LOGGING DENIALS WITH TEXT ON LAST UPDATE ON TABLE PD.Employee;

To end the logging for PD.Employee table, the following statements can be executed:

END LOGGING DENIALS ON SELECT, UPDATE ON TABLE PD.Employee;END LOGGING ON INSERT, DELETE, UPDATE ON TABLE PD.Employee;

To verify the rules have been removed, use the DBC.AccLogRules view:

SELECT UserName (CHAR (6)) AS "User//Name"

,DatabaseName (CHAR (6)) AS "Dbase//Name",TVMName (CHAR (10)) AS "TVM//Name",AcrSelect, AcrInsert, AcrDelete, AcrUpdate

FROM DBC.AccLogRulesWHERE DatabaseName = 'PD';

User Dbase TVM

Name Name Name SEL INS DEL UPD Rules for PD.Employee havebeen removed.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 14/28

Query Logging (DBQL) Concepts

• DBQL is a V2R5 feature created to log historical query information.

 – Not intended for live review of queries and query steps (use Performance Monitor) 

• DBQL caches and eventually stores query information in multiple TeradataData Dictionary tables as the queries are executed.

• Logging is invoked and revoked via SQL statements (BEGIN QUERY

LOGGING … and END QUERY LOGGING …)

 – Logging can be invoked for all users, a list of users, a list of account strings or aparticular user with one or more account strings.

• By default, 1 row per query is logged that contains user id information andsome statistics for that query. 

 – Options are available to expand the amount and kind of information to be logged.

• Notes and limitations include

 – Only tracks SQL (note that TPump sends SQL to Teradata)

 – Doesn’t log logons and logoffs 

 – Utilities will be included in future

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 15/28

Objects used in Defining Rules for DBQL

Users who are granted EXECUTE permission on the following macro can use

the BEGIN QUERY LOGGING and END QUERY LOGGING statements.

DBC.DBQLAccessMacro

DD/D MacroExample:

GRANT EXECUTE ON DBC.DBQLAccessMacro TOSysdba;

Initially, only DBC and SystemFE users are allowed to

issue BEGIN/END QUERY LOGGING statements.

Execution of BEGIN QUERY LOGGING or END QUERYLOGGING statements causes rows (representing therules) to be added or updated in … 

To view the rules in this table, SELECT from this view.

DBC.DBQLRuleTbl

DD/D Tables

DBC.DBQLRules

DD/D View

There are 6 additional tables and 6 additional views that are used

to hold and view captured query data (shown on next page).

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 16/28

Objects used in DBQL (cont.)

The views and associated tables used to hold query data are ...

DBC.DBQLogTbl

DD/D TablesDD/D Views

DBC.QryLog

DBC.DBQLStepTblDBC.QryLogSteps

DBC.DBQLObjTblDBC.QryLogObjects

DBC.DBQLSqlTblDBC.QryLogSQL

DBC.DBQLSummaryTblDBC.QryLogSummary

DBC.DBQLExplainTblDBC.QryLogExplain

Stores default rows (key table)

One row per step

One row per object referencedin query

Stores full SQL text - multiplerows may be needed

Queries meeting Summary or Threshold rules

Not used in V2R5; plan is tostore EXPLAIN of query

DBQL Purpose

Details on the columns in these views are located in Appendix E.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 17/28

BEGIN QUERY LOGGING Statement

• A BEGIN QUERY LOGGING statement without the WITH or LIMIT options causes defaultrows to be placed in the DBQLogTbl. A default row contains: 

 – User name, account string (expanded), time stamp information – Unique ID for process, session, and client (host) connection – First 200 characters of SQL statement

• Use of the WITH option(s) cause a default row to be placed in DBC.DBQLogTbl plusadditional rows in other DBQL tables.

The LIMIT option may be used to limit the amount of SQL text captured, set thresholds,or just capture summary information.

BEGIN QUERY LOGGING A

,WITH logging_opt ion  LIMIT l imi t_opt ion  

AND l imi t_opt ion  

A ON ALL

, ;

,

user_name  

,

ACCOUNT = ( 'account_name'  )

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 18/28

BEGIN QUERY LOGGING WITH ... (Cont.)

• WITH ALL … generates – one row per query in DBQLogTbl which includes 200 characters of SQL statement – one row per target object per query in DBQLObjTbl – one row per step per query in DBQLStepTbl –

one or more rows per complete SQL statement in DBQLSqlTbl• WITH OBJECTS 

 – one row per target object per query in DBQLObjTbl plus default row in DBQLogTbl

• WITH SQL  – logs the entire SQL for each request for each user being logged in DBQLSqlTbl

plus default row in DBQLogTbl

• WITH STEPINFO – inserts one row per step per query in DBQLStepTbl plus default row

BEGIN QUERY LOGGING A

,

WITH logging_opt ion  LIMIT l imi t_opt ion  

AND l imi t_opt ion  

A ON ALL

, ;

,

user_name  

,ACCOUNT = ( 'account_name'  )

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 19/28

BEGIN QUERY LOGGING LIMIT … (cont.) 

• LIMIT SQLTEXT  – specify the amount of SQL text to capture in the default row of DBQLogTbl. (Default is 200 char., 0 = off, max = 10,000 characters)

• LIMIT SUMMARY (For short high volume queries – example OLTP)

 –

Counts queries; count is written in DBQLSummaryTbl every 10 min (if count > 0) – SUMMARY doesn’t generate default rows in DBQLogTbl 

•  LIMIT THRESHOLD (Also for short high-volume queries – example OLTP)

 – Similar to SUMMARY, but default rows are generated in DBQLogTbl

 – Threshold, in seconds, determines whether to log a query or just count it.

• Query that complete <= threshold (sec.) are counted in DBQLSummaryTbl.

• Query that complete > threshold (sec.), DBQL logs the default row.

BEGIN QUERY LOGGING A

,

WITH logging_opt ion  LIMIT l imi t_opt ion  

AND l imi t_opt ion  

A ON ALL

, ;

,

user_name  

,ACCOUNT = ( 'account_name'  )

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 20/28

BEGIN QUERY LOGGING Examples

BEGIN QUERY LOGGING ON ALL;

BEGIN QUERY LOGGING ON tfact01, tfact02;

BEGIN QUERY LOGGING ON tfact03 ACCOUNT = ('$L', '$M');

BEGIN QUERY LOGGING ON ALL ACCOUNT = ('$L_&D&H', '$M_&D&H');

• This creates a rule for all users – you will not be able to create rules for specific users.

• If rules exist for specific users/accounts, then you cannot create a rule for ALL.

• This creates 2 rules - one for each specified user.

•  You can END QUERY LOGGING for either or both of the users.

• This creates 2 rules for a specific user  – each rule has a specific account ID.

• This creates 2 rules for all users – each rule identifies a specific account ID.

•  You can END QUERY LOGGING for either or both of the account IDs.

In these examples, the WITH and LIMIT options aren't used.Therefore, default rows will be created in the DBQLogTbl.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 21/28

BEGIN QUERY LOGGING Examples (cont.)

BEGIN QUERY LOGGING WITH ALL LIMIT SQLTEXT=0 ON ALL;

BEGIN QUERY LOGGING LIMIT SUMMARY = 5, 60, 600 ON ALL;

ALL options are logged for ALL users (probably generates too much information).

• Summary option is to only count running queries based on elapsed time. Counts arelogged in DBQLSummaryTbl every 10 minutes or when cache is full.

• 3 values (in sec.) are required. 4 count intervals are logged (<=5, <=60, <=600, >600)

• Summary limit cannot be used with any other limits

• If a query runs for less than 300 seconds (5 minutes), increment the count.

• If a query runs longer than 5 minutes, log a default row.

BEGIN QUERY LOGGING WITH STEPINFO, SQL LIMIT SQLTEXT=0 ON ALL;

• Default rows are logged as well as complete SQL text and one row per step.

• Since complete SQL text is captured in DBQLSqlTbl, no need to also capture SQL textin default row. Therefore, LIMIT SQLTEXT=0 doesn't capture SQL text in default row.

BEGIN QUERY LOGGING LIMIT THRESHOLD = 300 ON ALL;

In these examples, the ON option can also specify user name and/or account IDs.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 22/28

END QUERY LOGGING Statement

END QUERY LOGGING ON ALL

, ;,

user_name  

,

ACCOUNT = ( 'account_name'  )

• If “ON ALL” was used in the BEGIN statement, “ON ALL” must be used in the ENDstatement.

• If a list of users or a list of account strings was given in the BEGIN statement,logging can be ended on an individual basis.

• The “END QUERY LOGGING” statement will cause DBQL cache to be written to the

tables except for Summary cache.

END QUERY LOGGING ON ALL;

END QUERY LOGGING ON tfact01; (You can end logging for aspecific user.)

END QUERY LOGGING ON tfact03 ACCOUNT=('$H'); (You can end logging for aspecific account of a user.)

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 23/28

DBC.DBQLRules View

Returns information about current query logging rules.

SELECT UserName (CHAR (8)) AS "User",AccountString (CHAR (8)) AS "Acct_ID",SqlFlag AS "Sql" , TextSizeLimit

AS "Size",SummaryFlag AS "SumFl,SummaryVal1 AS "V1" , SummaryVal2 AS "V2" , SummaryVal3 AS "V3"

FROM DBC.DBQLRulesORDER BY 1;

Results:

DBC.DBQLRules

UserName AccountString ExplainFlag ObjFlagSqlFlag StepFlag SummaryFlag ThresholdFlagTextSizeLimit SummaryVal1 SummaryVal2 SummaryVal3ThreshValue

User Acct_ID Sql Size SumFl V1 V2 V3All $L_&D&H F 200 F ? ? ?All $M_&D&H F 200 F ? ? ?tfact01 F 500 F ? ? ?tfact02 F 500 F ? ? ?tfact03 $M F 200 F ? ? ?tfact03 $L F 200 F ? ? ?

tfact04 F 200 T 5 30 60tfact05 T 0 F ? ? ?

Example:

Note:BEGIN QUERYLOGGING statements

are shown on facingpage.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 24/28

DBC.QryLog View – Example

Returns information about default rows in the DBQLogTbl.

SELECT ProcID, CollectTimeStamp, QueryID, UserID, AcctString, ExpandAcctString,LogonDateTime, StartTIme, FirstStepTime, FirstRespTime, LastRespTime,NumSteps, QueryText

FROM DBC.QryLog 

WHERE QueryID = 11166;

Example of the data within one default row with a QueryID of 11166.

Result:

ProcID 16383CollectTimeStamp 2003-06-04 10:49:02

QueryID 11166UserID 00000704

AcctString $MExpandAcctString $M

LogonDateTime 2003-06-04 18:05:43StartTime 2003-06-04 18:10:16

FirstStepTime 2003-06-04 18:10:16FirstRespTime 2003-06-04 18:10:30LastRespTime 2003-06-04 18:10:30

NumSteps 5

QueryText SELECT * FROM DS.Sales_History ;

Result is shown inBTEQ with

SIDETITLES andFOLDLINE on.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 25/28

DBC.QryLogSummary View – Example

Returns information about summary rows in the DBQLSummaryTbl.

This example is based on the summary rule:

BEGIN QUERY LOGGING LIMIT SUMMARY = 5, 30, 60 ON tfact04; 

SELECT *FROM DBC.QryLogSummaryORDER BY 2, 3, 6;

Result:

ProcID CollectTimeStamp SessionID QueryCount QuerySeconds LowHist HighHist

16383 2003-06-04 18:59:08 1005 17 8 0 516383 2003-06-04 18:59:08 1005 1 17 5 3016383 2003-06-04 19:09:08 1005  38  14  0  5 16383 2003-06-04 19:09:08 1005  5  74  5  30 16383 2003-06-04 19:09:08 1005  2  81  30  60 16383 2003-06-04 19:09:08 1005  1  93  60  32767 16383 2003-06-04 19:09:08 1006 4 2 0 516383 2003-06-04 19:09:08 1006 2 33 5 3016383 2003-06-04 19:09:08 1006 1 85 60 32767

1

2

3

1 – In this summary collection, no queries were executed that exceeded 30 seconds.

2 – In this summary collection, queries were executed in all 4 summary intervals.3 – In this summary collection, no queries were executed that ran between 30 and 60 seconds.

14 / 38 = .3774 / 5 = 14.8084 / 2 = 40.5093 / 1 = 93.00

For #2, the averagetime of queries canbe calculated:

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 26/28

Access and Query Logging Summary

There are two logging facilities available to the database and/or security

administrator.

• Access Logging Facility

 – Used for access and security audit analysis

• Query Logging Facility (DBQL) 

 – Used for query activity and workload analysis

Both facilities require establishing a set of rules.

• Access Logging rules are stored in DBC.AccLogRules table. 

 –

Contains current access logging rules generated by BEGIN LOGGING andEND LOGGING statements.

• DBQL (Query Logging) rules are stored in DBC.DBQLRuleTbl. 

 – Contains current query logging rules generated by BEGIN QUERY LOGGINGand END QUERY LOGGING statements.

Both facilities provide a set of views to display logged information.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 27/28

Review Questions

1. In order to use the BEGIN/END LOGGING commands, what is the name of the system macro youneed execute permission on?

 _________________________________________ 

2. How is this macro initially created?

 _________________________________________ 

3. What is a negative impact of the following statement?

BEGIN LOGGING WITH TEXT ON EACH …… 

 _________________________________________ 

4. With DBQL, what is the size of the default text captured for queries? ________ 

5. True or False. With DBQL, the LIMIT SUMMARY option cannot be used with any other LIMIT.

6. True or False. With DBQL, the WITH SQL option only captures a maximum of 10,000 characters.

7. True or False. With DBQL, the option WITH ALL ON ALL is typically a good choice.

8. True or False. With DBQL, default rows are logged in the DBC.DBQLogTbl.

7/27/2019 B408 AccLog

http://slidepdf.com/reader/full/b408-acclog 28/28

Module 8: Review Question Answers

1. In order to use the BEGIN/END LOGGING commands, what is the name of the system macro youneed execute permission on?

DBC.AccLogRule  

2. How is this macro initially created?

When the DIP sc ript (DIPACC) is executed.  

3. What is a negative impact of the following statement?

BEGIN LOGGING WITH TEXT ON EACH …… 

Potent ial ly a lot of entr ies are placed in the dic t ionary and w ould require a lot of PERM space. 

4. With DBQL, what is the size of the default text captured for queries? 200 characters  

5. True or False. With DBQL, the LIMIT SUMMARY option cannot be used with any other LIMIT.

6. True or False . With DBQL, the WITH SQL option only captures a maximum of 10,000 characters.

7. True or False . With DBQL, the option WITH ALL ON ALL is typically a good choice.

8. True or False. With DBQL, default rows are logged in the DBC.DBQLogTbl.