We are running CICS TS 1.3 and also DB2. For auditing and investigation
purposes we need to find out periodically who may have accessed specific
information in DB2 from a CICS transaction. Is there an easy way to tie a
specific transaction execution to the data requested from DB2? We have
private data that a user may have access to but the information is
confidential and we may get reports that they haven't held the information
in confidence and we need to find out who may have accessed some very
specific data in DB2.
It looks like to me you have a rather open access to DB2 data and you now
want to start controlling it.
I'd recommend that you start applying Security to DB2 Tables so that you
can actually restrict access rather than worrying about who-did-what after
CICS does not supply any exits or other facilities to intercept data
returned from DB2 so that you can log it for offline activity. The closest
you can get to this is to look at the SMF data and see what tables are
bring accessed - but that will not help you.
I think I'd turn on DB2 Auditing functions and then drive your analysis
from that end. Details about this are in the Auditing section of the DB2
This was first published in October 2002