Format of audit row

Length

A two-byte field that indicates the length of this audit row, excluding this field itself.

Appl Data

A four-byte field that is reserved for application program usage. When writing a row, the audit server initializes this field to zeroes.

Action

A one-byte character code that indicates the action carried out on the table. These codes are available:

• -C: Create table
• -R: Drop table
• -L: Clear table
• -I: Insert row
• -D: Delete row
• -U: Update row

Data

The previous fields fulfill the audit requirement for table-level actions. No Data field is included for table-level actions.

For row-level actions, the important values of audited fields are stored as data, as described in the following sections.

Insert/Delete actions

Values of all audited fields are stored for insert and delete actions. These values are stored in the same field order as that of the audit-data dictionary of a sequence header. If the audit-data dictionary of a table has columns in the order c4, c2, c1, c3, c6, the values are stored in the same order.

Update actions

For update actions, the field number precedes the field values in the audit row. Field numbers that are used here are related to the sequence of fields in the audit-data dictionary and not to the original table data dictionary. Suppose a table has columns c1, c2, c3, c4, c5, and c6, with primary key (c4, c2), and all except c5 are audited. The audit-data dictionary contains information for these columns in order c4, c2, c1, c3, and c6.

Therefore, the field number 0 refers to field c4 and not to field c1. Similarly, field 3 refers to c1 and not to c3. For update actions, an audit row looks like this:

A single field entry is:

Field Number

A two-byte entry that indicates the field in the audit-data dictionary.

Changed

A single-byte flag that enables you to indicate whether or not the field is updated. The field value for primary key fields must be stored, whether the fields are changed or not. If you change the field value, the corresponding flag is set to Y. Otherwise, the flag is set to N. The values for all other audited fields are stored in the audit row only if the fields are changed, therefore, for these fields, the flag is always set to Y.

Old Value

The old value of the field that is being updated. For a primary key column that is not changed, this value is the only value stored.

New Value

If an audited field value is changed, this represents the new value. For primary key audited fields that are not changed, this field is not present in the audit row.

The primary key field (audited) is not changed. In this case, the field entry is:

The primary key field or any other audited fields are changed. In this case, the field entry is as follows:

Here, the new value follows the old value.