Safeguard Audit Service Manual (G06.24+, H06.03+)

ManualsBrandsHP ManualsServerHP NonStop G-Series

101

102

103

104

105

106

107

108

109

110

Producing SAFEART Reports

Safeguard Audit Service Manual—520480-014

6-18

Reviewing Reports

-- Select events where specified operator is the subject:

SET WHERE subjectusernumber=255,60, 255,22, 255,77, 255,55

SET WHERE subjectusernumber=255,79, 255,48, 255,75, 255,97

SET WHERE subjectusernumber=255,4

-- Select events where specified operator ID is the object:

SET WHERE guarduserusernumber=255,60, 255,22, 255,77, 255,55

SET WHERE guarduserusernumber=255,79, 255,48, 255,75, 255,97

SET WHERE guarduserusernumber=255,4

Reviewing Reports

SAFEART includes only complete audit events in its report. Every event is described

by a primary record. Many events also have one or more secondary records

associated with the primary record.

Selected events are written to the report with the primary record shown first, followed

by any secondary records. All events are separated by dashed lines. SAFEART reports

on the selected events in the order that they are found in the audit trail. They might not

be in strict chronological order because multiple processors write records in the audit

files. For a sample report, see Example 7-1 on page 7-2.

Primary Record

The primary record contains general information about the event, such as the name of

the object and the type of operation being attempted. You probably do not need to

examine all of the fields in the primary record. A small number of fields contain most of

the information you are likely to need.

Information About the Subject

In many cases, these primary record fields can help you determine who attempted the

operation and where the attempt originated:

For some operations, such as VerifyUser, these fields do not describe the user

attempting an operation. For more information, see Special Considerations for Subject

Fields on page 6-19.

Note. SAFEART does not print a partial event. If a primary record is missing a secondary

record or a secondary record has no primary record, the event is omitted from the report, and a

warning message is issued.

SubjectUserName The name of the user or alias attempting the action

SubjectUserNumber The number of the user or alias attempting the action

SubjectTerminalName Where the attempted action was initiated