TMF Application Programmer's Guide (G06.24+)

TMF ARLIB2 Audit-Reading Procedures
HP NonStop TMF Application Programmer’s Guide—522419-004
5-8
Reading Active Audit Files
(provided you specified 999999 as the maximum sequence number in the AROPEN
call that opened the cursor).
The procedure for reading audit records from an active-audit trail is as follows:
1. Open a cursor for the audit trail by calling AROPEN.
Use a fully qualified file name or the appropriate audit-trail ID (MAT, AUX01,
AUX02, ...) as the generic-name. When using the fully qualified file name, the
volume name is meaningless because ARLIB2 consults the TMP to determine the
location of the audit trail, the subvolume name must be ZTMFAT, and the filename
should be the appropriate two-character identifier (AA, BB, CC, ...).
Use the desired starting audit-file sequence number as the min-seqno parameter
value and 999999 as the max-seqno parameter value.
ARLIB2 correctly processes multiple active-audit volumes, overflow-audit volumes,
and restore-audit volumes. If audit restore is necessary and enabled, the TMP
uses the TMF dump/restore capability to restore audit-trail files to one of the
configured restore-audit volumes.
2. Set the position at which to start reading by calling ARPOSITION.
To read forward from the beginning of the audit file specified in the AROPEN call,
set the audit-file-seqno parameter to the same value as the AROPEN
min-seqno parameter, the rel-byte-addr parameter to zero, and the
cursor-direction parameter to zero.
To read in reverse from the end of the current active audit file back to the beginning
of the audit file specified in the AROPEN call, set the audit-file-seqno
parameter to 999999, the audit-file-rba parameter to -1, and the
cursor-direction parameter to any value greater than zero.
3. Retrieve successive audit records by repeatedly calling ARREAD.
When reading forward, ARE-END-OF-AUDIT indicates that you have reached the
end of the current active audit file. To retrieve newly added audit records, pause
briefly and then issue another ARREAD. That call will return either a new audit
record (if available) or an ARE-END-OF-AUDIT message. If the call returns a new
audit record, issue another ARREAD. If the call returns an ARE-END-OF-AUDIT,
then pause once again and issue another ARREAD, and so forth.
When reading in reverse, ARE-END-OF-AUDIT indicates that you have reached
the beginning of the audit file specified by the min-seqno parameter in the
AROPEN call.