7.1.1 Disable the Audit Buffer

Information

Db2 can be configured to use an audit buffer where individual audit events are gathered into a large buffer to improve performance by reducing the number of writes to disk. It is recommended that the audit buffer be disabled by setting the size to 0.

Rationale:

Increasing the audit buffer size to greater than 0 will allocate space for the audit records generated by the audit facility. At scheduled intervals, or when the audit buffer is full, the db2auditd audit daemon empties the audit buffer to disk, writing the audit records asynchronously. As the events are held in memory for some time before being written to disk, if the database server happened to crash those event would be lost. Setting the buffer size to 0 ensure events are written directly to disk.

Impact:

Disabling the audit buffer may have noticeable impact on overall performance of the database server.

Solution

Perform the following to disable the audit buffer:

Attach to the Db2 instance

db2 => attach to <db2instance>

Run the following command:

db2 => update database manager configuration using audit_buf_sz 0

See Also

https://workbench.cisecurity.org/benchmarks/10752

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4, CSCv7|6.4

Plugin: Windows

Control ID: 2bedb14459528c280fe108a67bcb96869eda6f3a12693f28f7840bf6ded76ccd