Safeguard Audit Service Manual (G06.24+, H06.03+)

Audit File Record Formats
Safeguard Audit Service Manual—520480-014
A-7
Primary Audit Record
ZAUDITNUMBER
is a binary integer that identifies an audited event in the security audit pool. For
events whose descriptions span more than one record, the several records
involved are linked by a common value of ZAUDITNUMBER.
ZTIME-REPORTED
is a 64-bit timestamp specifying the date and Greenwich mean time when the audit
service client interface sent the event description to the audit service collector
process.
ZTIME-RECEIVED
is a 64-bit timestamp specifying the date and Greenwich mean time when the
event description was received by the audit service collector process.
ZVERACITY
is the level of trust that can be placed on the contents of this record. This level
depends on the source of the audit request, trusted or untrusted, and the errors or
lack of errors in the audit request itself.
These levels are defined ZVERACITY:
ZSFG-VAL-VER-TR
indicates that the request originated from a trusted client and no errors were
detected in the audit request.
ZSFG-VAL-VER-TR-IN-ERROR
indicates that the request originated from a trusted client and errors were
detected. Audit requests are not rejected because of errors detected in the
request. Instead, audit records resulting from such a request are marked to
indicate that they might contain erroneous data before they are written to the
audit pool.
ZSFG-VAL-VER-TR-UNCHECKED
indicates that the request originated from a trusted client and was not checked
for errors. In this product version of the audit service, this value does not
normally occur.
ZSFG-VAL-VER-UNTR
indicates that the request originated from an untrusted client and no errors
were detected in the audit request.
ZSFG-VAL-VER-UNTR-IN-ERROR
indicates that the request originated from an untrusted client and errors were
detected. Audit requests are not rejected because of errors detected in the