database - Reading from the sysaudits table - Sybase ASE 15.7 -

i trying collect audit logs sybase ase 15.7 sysaudits table. siem using query read audit logs. since sysaudits table can read users sso role , had find alternative since cannot give privilege siem. our dba tried create view purpose since account used siem not having sso role failed. dba proposed create table same structure (event, eventmod, spid, eventtime, sequence, suid, dbid, objid, xactid, loginname, dbname, objname, objowner, extrainfo, nodeid) , write script read sysaudits table , write new table every 5 minutes. went ahead solution, ran across problem why need help

the siem solution read using query provided dba, siem solution needs unique column keep track of record last read. noticed there no such unique column in sysaudits. moreover, noticed commands broken multiple entries , keep track of them sequence id used.

• i thinking if should add auto incrementing column id. in keeping track of audit logs.
• for sequence id , commands broken in multiple entries, thinking perhaps use script reads sysaudits , when encounters command broken in multiple entries, merge 1 entry , write our table rather original multiple entries sequence numbers.

how should frame query this? or there better way of going this?

also, noticed 92 in event column event though sybase specified can different values event field. supposed other values also?

thanks in advance