Safeguard Audit Service Manual (G06.24+, H06.03+)

Safeguard Audit Service Manual—520480-014
6-1
6 Producing SAFEART Reports
SAFEART allows you to produce reports of security-relevant events based on criteria
you specify. Minimally, you must specify the audit files from which to extract
information. However, to limit the scope of a report, you should also specify a time
period and the types of events to include.
If you do not specify a time period and a subset of events, SAFEART includes all
events from the audit files, which is usually too much information. Specify criteria for
selecting events through the SET WHERE command.
Selected events might not always appear in a SAFEART report. For example, if no
events of the selected type occurred, or if auditing was not in effect for the selected
events, they do not appear in the report.
General Procedure for Producing Reports
SAFEART produces a report of audited events based on the commands you issue.
The general procedure for producing a report during a SAFEART session is:
1. Check the attributes currently in effect for your session using the SHOW *
command. If necessary, you can return an attribute to its default value with the
RESET command.
2. Specify the files used by SAFEART to produce a report. Use the AUDIT FILE
command to specify the audit files to be used as the source of the report. Use the
SET DESTINATION FILE command to specify where the report is to be sent.
3. If you prefer, customize the format of your report using the SET TITLE and SET
PAGE SIZE commands.
4. Specify a time interval for the report using the SET START TIME and SET END
TIME commands.
5. Specify the type of events you want to search for by using the SET WHERE
command. For usage of the SET WHERE command, see Specifying Selection
Criteria on page 6-9.
6. Verify that the parameters for the report are correct by issuing the SHOW *
command again.
7. Begin generation of the report using the START command.
8. Confirm completion of the report. SAFEART prints a report summary when the
report is complete. The report summary is sent to your home terminal or the OUT
file if you specify one. The full report is sent to the specified DESTINATION FILE.
For guidelines for reviewing SAFEART reports, see Reviewing Reports on
page 6-18.