Sybase query to retrieve dba activity

Question

I am new to Sybase ASE, I needed help in crafting a query which will retrieve from the Sybase database the database administrator activity (specific db users). DBA has informed that the auditing has been enabled on the Sybase database. The logging solution requires a Sybase query to read from Sybase.

Kinda like reading the DBA_COMMON_AUDIT_TRAIL in Oracle.

Thanks.

Answer 1

audit_db is typically the database name, and audit_data is the table that stores the trail.

I would suggest that you read the Auditing section of the Security Administration Guide for Sybase ASE.

It includes a section on querying the data, as well as what all the flags and values are.

Answer 2

To write a query, You need to understand what are the options enabled on the sybase instance to be audited. When we enable the auditing, it basically records just the login attempts of any user. To get more information from the audit tables, You should have other audit option enabled. It can easily be checked from sp_displayaudit. The data that you require are saved in tables named as sysaudits_01, sysaudits_02 in database sybsecurity database. If different audit options are enabled, You can easily query these tables using pl/sql.

Please let me know if this helps!!