Linking Application Audit Trail with DB Logs

Question

I'm working on an application that logs every business transaction to an audit trail, and I have a requirement to be able to correlate events in this audit trail with records in the Journal of an IBM System i (AS400) that is used as an RDBMS by that application. Any idea how can this be achieved?

I was thinking if there is a way for the application to pass some sort of business transaction ID to the database and have it stored with it's corresponding journal entries. Is this possible?

Answer 1

The journal entries carry every column of the journalled table, so if there is a transaction ID in the row, it will be in the journal. It is very rare to encounter a business system without a transaction ID; it may be an invoice number, a purchase order number, a requisition number and so on. If you have come across one, there is almost always a primary / foreign key pair that identifies the transaction. Think customer number, item number for a sale, vendor number, check number for accounts payable, etc.

Frankly, the journal tends to be a better audit trail than any application-generated audit trail because the journal will catch 'fix it' situations like a programmer using an SQL UPDATE to repair rows incorrectly updated due to a program bug and the like.

Answer 2

I agree journaling is likely to be a significantly better solution. There have been sites that are concerned about journal performance hits; but those concerns often ignore the performance hits of bolting on procedures that also do disk writes. It's a near certainty that built-in system journal routines will be more efficient than any routines written in a HLL.

It seems bizarre to create a physically separate "audit trail" that needs to be "correlated" with existing journal entries. The journal IS the audit trail.

However, your question isn't clear. Are you simply asking how to read a journal?

If so, there are two general approaches. You can either output a selected set of journal entries to an temporary work table or use system commands or APIs to retrieve journal entries into program buffers. If you retrieve into a program's memory, you can do anything with the data you might want, e.g., query your "audit trail" to find a matching data element.

Can you give a little more detail on the process you have in mind?