Safeguard Audit Service Manual (G06.24+, H06.03+)

SAFEART Field Descriptions
Safeguard Audit Service Manual—520480-014
7-7
Variable ObjectName Field
OSS Fileset: the fileset name, such as ROOT.
OSS File: the path name used to access the file.
The actual pathname audited is absolute and is normalized to have all '.', '..', multiple
slashes and symbolic link references resolved. If the length of this pathname exceeds
1023 bytes, the audited name consists of three periods ('...') followed by the last 1020
bytes of the path name.
The internal name also depends on the type of object being audited.
OSS Fileset: $ZPMON.Znnnnn:yyyymmddhhmmss
where nnnnn is the fileset device number and yyyymmddhhmmss is the time when
the fileset was created.
Example
$ZPMON.Z00000:19980119152451
OSS Regular File: $VOL.ZYQnnnnn:Ziiiiiii:ccccccccccc
(disk file) where nnnnn is the fileset device number, iiiiiii is the file's inode,
number and ccccccccccc is the file's creation version sequence number
(CRVSN) (leading zeros suppressed).
Example
$OSS1.ZYQ00000.Z00004G6:1934568735
Other OSS Files: $ZPNS.Znnnnn.Ziiiiiii:ccccccccccc
(such as AF_UNIX sockets) where nnnnn is the fileset device number, iiiiiii is
the file's inode number, and ccccccccccc is the file's CRVSN (leading zeros
suppressed).
Example
$ZPNS.Z00000.Z00004G5:3987764537
A mount point path name is present only in the record generated by the fileset
Mount command.
The object name in the audit record generated by the disk process (DP2) is also in
external name=internal name format for all functions audited by DP2, whenever
possible. When external name is not known, only the internal name, as
described previously, is stored in the audit record.
This occurs for open(), FILE_OPEN_() and write operations. In these cases, a
preceding RESOLVE record contains both the external and internal name.