DB2 Event and RACF Profie Monitoring

Products

• Compliance Event Manager

Issue/Introduction

Is it possible to monitor the DB2 events like UPDATE/DELETE/INSERT or profiles defined to RACF via Compliance Event Manager?

Environment

z/os DB2 RACF

Resolution

This answer is no it does not monitor these events directly. CEM currently does not monitor native events that occur within Db2, like UPDATEs, GRANT, ALERT or RACF profiles.
It is on the roadmap for the furture but there is no specific date/time frame for this.
But for native DB2 events, if the DB2 external RACF security exit is active, this calls the ESM to determine if a user has access to a particular resource. IF the exit is in place making these external ESM calls,then the events will also be passed to Compliace Event Manager if being monitored.

These ESM events checking access would come into CEM as an Object Access or Object Access Violation event. The customer exit and how it is coded (what checks are/are not performed) will control how much if any events make it to CEM.