For single-table auditing, the threshold procedure should:
Archive the almost-full audit table to another table, using the insert and select commands.
Truncate the audit table to create space for new audit records, using the truncate table command.
Before you can archive your audit records, create an archive table that has the same columns as your audit table. After you have done this, your threshold procedure can use insert with select to copy the audit records into the archive table.
Here is a sample threshold procedure for use with a single audit table:
create procedure audit_thresh as /* ** copy the audit records from the audit table to ** the archive table */ insert aud_db.sso_user.audit_data select * from sysaudits_01 return(0) go /* ** truncate the audit table to make room for new ** audit records */ truncate table “sysaudits_01” go
After you have created your threshold procedure, you will need to attach the procedure to the audit table segment. For instructions, see “Attaching the threshold procedure to each audit segment”.
WARNING! On a multiprocessor, the audit table may fill up even if you have a threshold procedure that triggers before the audit table is full. For example, if the threshold procedure is running on a heavily loaded CPU, and a user process performing auditable events is running on a less heavily loaded CPU, it is possible that the audit table can fill up before the threshold procedure triggers. The configuration parameter suspend audit when device full determines what happens when the audit table fills up. For information about setting this parameter, see “Suspending auditing if devices are full”.
