Informix auditing logs activities matching events that have been added to audit masks. A major use case for Informix auditing is to track who connects to the instance and when.

The obvious event code to track is OPDB – Open Database. However, this only captures explicit connections to a database. Notably remote connections from other instances are not recorded. For example, the following will NOT trigger the OPDB event in the warehouse instance:

dbaccess proddb <<EOF
select count(*) from trace@warehouse:systables;
EOF

Such events can be captured by adding the event code STSN – Start New Session to the _require auditing mask, for example:

onaudit -m -u _require +STSN

Now the query above will record the connection attempt, e.g.

ONLN|2026-11-06 17:39:11.987| prodserv|25887|warehouse|informix|0:STSN

Note that unlike the OPDB event, the STSN event does not record any additional information and does not include the name of the database that was accessed.

-Mike Walker (mike@xdbsystems.com)