OSF DCE Administration Guide--Core Components

DCE Audit Service
42.3.5.4 Event Class Number Formats
Event class numbers follow one of five formats (A to E), depending on the number of
event classes in the organization. The format of an event class number can be
determined from its four high-order bits.
Format A can be used by large organizations (such as OSF or major DCE vendors) that
need more than 16 bits for the class ID. This format allocates 7 bits to the set ID and 24
bits to the class ID. Format A event class numbers with zero (0) as its set ID are assigned
to OSF. That is, all event class numbers used by OSF have a zero in the most significant
byte.
Format B can be used by intermediate-sized organizations that need 8 to 16 bits for the
class ID.
Format C can be used by small organizations that need less than 8 bits for the class ID.
Format D is not administered by OSF and can be used freely within the cell. These event
class numbers cannot be unique across cells and should not be used by application
servers that are installed in more than one cell.
Format E is reserved for future use.
The numbers with 110 in the most significant bits (that is, 0xC0000000 to 0xDFFFFFFF)
are reserved to be used locally within a cell.
The event class number formats are illustrated in Figure 42-1.
Figure 42-1. Event Class Number Formats
Format A
Format B
Format C
Format D
Format E
0 1 2 3 4 8 16 24 31
0 set–id event–id
1 0 set–id event–id
1 1 0 set–id event–id
1 1 1 0 event–id
1 1 1 1 reserved
The cell administrator is responsible for administering and assigning local event class
numbers and their names.
42.3.6 Filters
Once the code points are identified and placed in the application server, all audit events
corresponding to the code points will be logged in the audit trail file, irrespective of the
outcome of these audit events. However, recording all audit events under all conditions
may neither be practical nor necessary. Filters provide a means by which audit records
are logged only when certain conditions are satsified. The administrator defines filters
using the DCE control program.
124243 Tandem Computers Incorporated 42−5