Examples of audit trail collection are shown below.

Example 1: Collect an audit trail of table accesses

When a table is accessed, the table's access privilege (SELECT privilege) is used, and an audit trail is collected.

Table search contents (SQL specification)		Audit trail contents
		Executor	Privilege used	Manipulated object	Manipulated object's name	Action
A user (USR1) issues the following SELECT statement: SELECT C1 FROM USR1.T1	Privilege	USR1	Table access (SELECT privilege)	Table	USR1.T1	Accesses a table (SELECT)
	Termination	USR1	--	Table	USR1.T1	Accesses a table (SELECT)
A user (USR2) issues the following SELECT statement: SELECT T1.C1,T2.C1 FROM USR1.T1 T1,USR2.T2 T2 WHERE T1.C1=T2.C1	Privilege	USR2	Table access (SELECT privilege)	Table	USR1.T1	Accesses a table (SELECT)
		USR2	Table access (SELECT privilege)	Table	USR2.T2	Accesses a table (SELECT)
	Termination	USR2	--	Table	USR1.T1	Accesses a table (SELECT)
		USR2	--	Table	USR2.T2	Accesses a table (SELECT)

Legend:

Privilege: Audit trail collected during privilege checking

Termination: Audit trail collected at event termination

--: Not applicable

Example 2: Collect an audit trail of table definitions and deletions

When a table is defined or deleted, schema owner privilege, table owner privilege, and RDAREA usage privilege are used, and an audit trail is collected.

Table search contents (SQL specification)		Audit trail contents
		Executor	Privilege used	Manipulated object	Manipulated object's name	Action
A user (USR1) issues the following CREATE TABLE statement: CREATE TABLE T1(C1 INT) IN RDAREA1	Privilege	USR1	RDAREA usage privilege	RDAREA	RDAREA1	Creates a definition
		USR1	Owner	Schema	USR1	Creates a definition
		USR1	Owner	Table	USR1.T1	Creates a definition
	Termination	USR1	--	Table	USR1.T1	Creates a definition
A user (USR2) issues the following DROP TABLE statement: DROP TABLE T1	Privilege	USR2	Owner	Table	USR2.T1	Deletes a definition
	Termination	USR2	--	Table	USR2.T1	Deletes a definition

Legend:

Privilege: Audit trail collected during privilege checking

Termination: Audit trail collected at event termination

--: Not applicable