Safeguard Audit Service Manual (G06.29+, H06.08+, J06.03+)

Producing SAFEART Reports
Safeguard Audit Service Manual — 520480-031
6 - 20
Special Considerations for Subject Fields
Automatic Logoff Events
A user is automatically logged off if another user successfully logs on at the same
terminal. This type of event is represented by a Logoff operation. The logged-off user is
represented by the fields with the Subject prefix and the fields GuarduserUserName,
GuarduserUserNumber, and UserAliasName. The newly logged on user is represented
by the fields LogonUserName, LogonUserNumber, and LogonAliasName, which
appear in the secondary text area. This type of event is accompanied by a
corresponding VerifyUser event.
Authenticate Events
Authenticate events occur when a client subsystem requests a check of a user’s
identity. An Authenticate event differs from a VerifyUser event because a user’s identity
is checked, but the user is not necessarily logged on. The Subject area represents the
user process under which the requesting client is running. The user ID being checked
is represented by the fields GuarduserUserName, GuarduserUserNumber, and
UserAliasName. The field UserPrivLogonOper denotes whether the requested
operation is privlogon.
Password Change Events
Changing password of a user is referred to as Password Change event. You can
change a user’s password using:
•
Safeguard
•
STD-SECURITY utility PASSWORD program.
While changing a user’s password using Safeguard, the SubjectUserName and
SubjectUserNumber fields refer to the user process that is in control of the terminal
when the password is being changed. The SubjectCreatorName field refers to the
requestor process requesting the change of password.
While changing a user’s password using the P
ASSWORD program, the SWITCHUSER
call switches the current user to SUPER.SUPER so that the user ID file can be read.
Thus, the SubjectUserName and SubjectUserNumber fields refer to the present user
(that is, SUPER.SUPER) and the SubjectCreatorName field refers to the requested
user.