Safeguard Audit Service Manual (G06.24+, H06.03+)

SAFEART Field Descriptions
Safeguard Audit Service Manual—520480-014
7-8
Secondary Record Fields
The object name in the audit record generated by NonStop Kernel (T9050) is the
textual representation of the process handle for operations such as:
•
process creation (exec() family, PROCESS_SPAWN_(), fork())
•
kill()
•
setsid(), setpgid()
This existing format is used to store the object name:
\SYSNAME.$PNAME[,CPU,PIN][:VERIFIER]
\SYSNAME.CPU,PIN[:VERIFIER]
\###.$NAME[,CPU,PIN][:VERIFIER]
\###.CPU,PIN[:VERIFIER]
where ### is the system node number.
Secondary Record Fields
Some audited events might include one or more secondary records. Secondary
records provide additional information about an event. The additional information is
recorded in the text area of the secondary record, which is described in the following
pages. In addition to the text area, secondary records contain the six fields described
in Table 7-2. As noted, you cannot use some of these fields in SET WHERE
commands.
Table 7-2. Secondary Record Fields (page 1 of 2)
Field Name Field Type Description
SecondaryAuditnumber Numeric Identifies the audited event. The secondary
record is linked to the primary record with a
matching Auditnumber. You cannot use this field
in SET WHERE commands.
SecondaryRecordType Enumerated Describes the type of record. Possible values
appear in Table 7-8
on page 7-51.
SecondaryTextAreaType Enumerated Identifies the type of structure that appears in the
text area immediately following this field.
Possible values appear in Table 7-9
on
page 7-51.