Analyzing database updates at the system level

As AI and other external systems create autonomous connections to IBM i data, it becomes increasingly important to monitor what is happening inside the system, even down to the field-level, in some cases.

iFileAudit is our product for capturing and analyzing data changes in your mission critical databases. It works by extracting transactions from IBM i database journals, storing the changes in a persistent relational database. You can think of it as a datamart for your critical data because it provides very similar functionality as the native IBM i datamart for the security audit journal.

Once the transactions are in the iFileAudit database they can be analyzed by date, time, user, program and more. iFileAudit also captures before and after values so you can see what data was changed.

iFileAudit stores transactions in member files — one for each journal being monitored. Since version 8.1 you can summarize changes across multiple members using a series of summary reports. Previous releases were limited to reporting against only one journal at a time.

These new management reports provide great high-level visibility into what is happening with your critical data. They can be used for management reporting or to feed a visibility dashboard or even a SIEM system that can detect behavioral anomalies.

Access the new management reports from the iFileAudit reports menu:

Each report will create a CSV file in the /kiscoifa folder in the IFS

Please note there is a command for each report. Use these commands to schedule running of management reports in the job scheduling utility of your choice.

With these reports you can:

• Summarize all activity across all monitored databases
• Summarize all database activity for a particular user or list of users
• Summarize activity for all users with special authorities on their user profile

Management reports support relative dates which will be a big help when you are running reports on an automated schedule. Prompt F4 to see the available date ranges:

Here is a sample of the CSV output:

Are you already using iFileAudit? Contact support@kisco.com to get the latest installer.

Looking to start tracking data changes? Contact sales@kisco.com for licensing information or to get help configuring your journal audit and reporting capabilities.