OSF DCE Administration Guide--Core Components

OSF DCE Administration Guide—Core Components
42.4 Administration and Programming in DCE Audit
Many of the DCE Audit Service administrative tasks are related to the tasks performed
by the application programer. To understand these administrative tasks, you should be
familiar with some programming aspects of the DCE Audit Service. This section
describes a typical DCE Audit Service programming and administrative scenario and
their tasks.
A banking server example illustrates this scenario.
42.4.1 Programmer Tasks
The application programmer uses the DCE audit APIs to enable auditing in the
application server program. Specifically, the programmer performs the following tasks:
1. Identifies the code points corresponding to the audit events in the application
server program.
For example, a banking server program can have these functions: acct_open(),
acct_close(), acct_withdraw(), acct_deposit( ), and acct_transfer(). Each of
these functions can be designated as a code point, meaning that these are possible
audit events that can be recorded (depending on the filter):
acct_open() /* first code point */
acct_close() /* second code point */
acct_withdraw() /* third code point */
acct_deposit() /* fourth code point */
acct_transfer() /* fifth code point */
2. Assigns an event number to each code point. The event numbers are used as
parameters by the dce_aud_open() API, which opens an audit trail, and the
dce_aud_start() API, which initializes the audit record for the code point. The
programmer may want to define these event numbers in the server’s header file.
For example:
/* event number for the first code point, acct_open() */
#define evt_vn_bank_server_acct_open 0x01000000
/* event number for the second code point, acct_close() */
#define evt_vn_bank_server_acct_close 0x01000001
/* event number for the third code point, acct_withdraw() */
#define evt_vn_bank_server_acct_withdraw 0x01000002
/* event number for the fourth code point, acct_deposit() */
#define evt_vn_bank_server_acct_deposit 0x01000003
/* event number for the fifth code point, acct_transfer() */
42 − 10 Tandem Computers Incorporated 124243