Safeguard Audit Service Manual (G06.24+, H06.03+)

Producing SAFEART Reports
Safeguard Audit Service Manual—520480-014
6-19
Secondary Record
Information About the Object
These primary record fields describe the object involved in the event.
In some cases, the object is actually a user ID or a user record. If so, the ObjectName
field is replaced by fields that describe the user ID.
Basic Information About the Event
These primary record fields contain basic event information:
Secondary Record
A secondary record contains the six standard fields described in Table 7-2 on page 7-8
followed by the SecondaryTextArea, which contains additional information about the
event.
The SecondaryTextArea often contains a representation of a Safeguard record. For a
description of the fields that make up the text areas for Safeguard records, see
Section 7, SAFEART Field Descriptions.
Special Considerations for Subject Fields
When the ObjectType is GuardianUser, the Subject fields in the primary record do not
represent the user attempting the operation. This situation occurs in the following
instances.
VerifyUser Events
Logon attempts are represented by a VerifyUser event. Fields with a prefix of Subject
refer to the user process that is in control of the terminal before the logon attempt. The
user attempting to log on is indicated by the fields GuarduserUserName,
GuarduserUserNumber, and UserAliasName, which appear in place of the
ObjectName field.
If the logon is successful, the LastLogonTime changes, resulting in a change to the
user record. This change causes a total of four secondary records to be generated—
two images of the user record and two images of the extension to the user record.
If the logon attempt fails, the value of LogonFailCount and StaticLogonFailCount
change, resulting in a change to the user record. This change also causes four
secondary records to be generated.
ObjectType The type of object involved
ObjectName The name of the object
Operation What action was attempted
Outcome Whether the operation succeeded
TimeReported When the attempted action was reported