Safeguard Audit Service Manual (G06.29+, H06.08+, J06.03+)

SAFEART Field Descriptions
Safeguard Audit Service Manual — 520480-031
7 - 10
Variable ObjectName Field
OSS Fileset: $ZPMON.Znnnnn:yyyymmddhhmmss
where nnnnn is the fileset device number and yyyymmddhhmmss is the time when
the fileset was created.
Example
$ZPMON.Z00000:19980119152451
OSS Regular File: $VOL.ZYQnnnnn:Ziiiiiii:ccccccccccc
(disk file) where nnnnn is the fileset device number, iiiiiii is the file's inode,
number and ccccccccccc is the file's creation version sequence number
(CRVSN) (leading zeros suppressed).
Example
$OSS1.ZYQ00000.Z00004G6:1934568735
Other OSS Files: $ZPNS.Znnnnn.Ziiiiiii:ccccccccccc
(such as AF_UNIX sockets) where nnnnn is the fileset device number, iiiiiii is
the file's inode number, and ccccccccccc is the file's CRVSN (leading zeros
suppressed).
Example
$ZPNS.Z00000.Z00004G5:3987764537
A mount point path name is present only in the record generated by the fileset
Mount command.
The object name in the audit record generated by the disk process (DP2) is also in
external name=internal name format for all functions audited by DP2, whenever
possible. When external name is not known, only the internal name, as
described previously, is stored in the audit record.
This occurs for open(), FILE_OPEN_() and write operations. In these cases, a
preceding RESOL
VE record contains both the external and internal name.
The object name in the audit record generated by NonStop Kernel (T9050) is the
textual representation of the process handle for operations such as:
•
process creation (exec() family, PROCESS_SPAWN_(), fork())
•
kill()
•
setsid(), setpgid()
This existing format is used to store the object name:
\SYSNAME.$PNAME[,CPU,PIN][:VERIFIER]
\SYSNAME.CPU,PIN[:VERIFIER]