Safeguard Audit Service Manual (G06.24+, H06.03+)

Producing SAFEART Reports
Safeguard Audit Service Manual—520480-014
6-12
Using Multiple Comparison Statements
If you use OwnerIsRemote in a comparison statement, you must compare it to one of
these values. For example:
<=SET WHERE OwnerIsRemote = local
Using Multiple Comparison Statements
When you use multiple comparison statements within a single SET WHERE command,
connect them with a logical operator (AND or OR). The logical operator determines
how the WHERE expression is evaluated.
However, when you use multiple comparison statements in separate SET WHERE
commands, one comparison statement to a command, SAFEART treats the
comparison statements as if they are joined with ORs.
The following example illustrates a single SET WHERE command containing more
than one comparison statement. It selects audit records for all logon attempts by user
ID 4,25.
<=SET WHERE SubjectUserNumber=4,25 AND Operation=VerifyUser
If the same selection criteria are specified in separate SET WHERE commands,
SAFEART treats them as though they are connected by ORs. Therefore, these SET
WHERE commands select all audited events performed by user ID 4,25 and all logon
attempts by all users:
<=SET WHERE SubjectUserNumber = 4,25
<=SET WHERE Operation = VerifyUser
Using More Than One Value in a Single Comparison Statement
If the operator in a comparison statement is the equal sign (=), you can compare the
same record-item to a list of values separated by commas. This comparison is
equivalent to respecifying the record-item in separate comparison statements
joined by the OR operator.
The following example shows how you can specify a list of values in a comparison so
that a single comparison statement is equivalent to multiple comparisons joined by OR
operators.
This SET WHERE command selects all audited operations in which the outcome was
an expired or invalid user password:
<=SET WHERE Outcome=UserPwExpired, UserPwInvalid
The previous command is equivalent to this command, which includes two separate
comparisons joined by the OR operator:
<=SET WHERE Outcome=UserPwExpired OR Outcome=UserPwInvalid
Note. If you specify an unnamed process in a comparison statement, enclose the process file
name in quotation marks. Otherwise, SAFEART interprets the comma in the process file name
as a separator of two values.