Make database activity meaningful to its owner
Powertech Database Monitor for IBM i is an enquiry about evidence around selected database activity. The useful requirement identifies which information, accounts and actions need review. A high event count is not the same as a complete view of a business transaction, especially where applications use shared service identities.
Start with sensitive objects, application access paths and the questions auditors or investigators need to answer. Confirm the selected product’s supported collection and reporting functions. Define the relationship between an application user and the database identity visible to the monitoring configuration, preserving attribution limitations where they exist.
Validate collection and the review workflow
Use an authorised test action and reconcile it with the resulting record: object, identity, operation and time context should be meaningful to the reviewer. Check collection coverage, resource impact and what happens when the expected evidence is unavailable. Retention and reviewer permissions should be approved before collecting production information.
The operating procedure needs an owner who can distinguish legitimate application work from an unexplained event and knows when to escalate. MMC can scope selected monitoring, reports and administrator handover. Blocking access, modifying applications or operating a continuously staffed investigation service are separate requirements that should not be inferred from the monitoring product.
Evidence to request for this scope
- Confirm auditable objects and event types against current product documentation.
- Trace an approved database action into the report and document identity-attribution limits.
- Agree retention, evidence access and escalation for missing or unexplained activity.