TMF Application Programmer's Guide (G06.26+)

TMF ARLIB2 Audit-Reading Procedures
HP NonStop TMF Application Programmer’s Guide—522419-005
5-10
Reading a Merged Audit Trail With a MERGE Cursor
value as the max-seqno parameter, the ARPOSITION rel-byte-addr
parameter to -1D, and the ARPOSITION cursor-direction parameter to any
value greater than zero.
3. Retrieve successive audit records by repeatedly calling ARREAD.
When reading forward, ARE-END-OF-AUDIT indicates that you have reached the
end of the audit file specified by the max-seqno parameter in the AROPEN call.
When reading in reverse, ARE-END-OF-AUDIT indicates that you have reached
the beginning of the audit file specified by the min-seqno parameter in the
AROPEN call.
Reading a Merged Audit Trail With a MERGE
Cursor
When using the ARLIB2 MERGE cursor, the application never sees AuxPointer
records. ARLIB2 merely uses those records to locate and return records from the
appropriate auxiliary audit trails.
The procedure for reading the MAT and all configured auxiliary audit trails as a merged
audit trail using the MERGE cursor is as follows:
1. Call AROPEN with "MERGE" as the generic-name for the cursor. Note that
“MERGE” functions as the audit-trail designator even if no auxiliary audit trails are
configured.
Specify the desired MAT low and high file-sequence numbers (min-seqno and
max-seqno). To designate the current active audit file as the high file-sequence
number, specify 999999 as the max-seqno.
2. Set the position in the MAT at which to start reading by calling ARPOSITION.
When you call ARPOSITION, you can also specify the desired starting position
within one of the configured auxiliary audit trails. If you specify both a MAT and
auxiliary position, however, they should be the values returned in an ARRECORD
or else unpredictable results may occur.
3. Retrieve successive audit records by repeatedly calling ARREAD.
When ARE-END-OF-AUDIT is returned, all audit records from the master and
auxiliary audit trails within the range determined by the ARPOSITION and
AROPEN calls have been returned.
If max-seqno in the AROPEN call was 999999, you have read to the end of the
merged audit trail. To retrieve newly added audit records, pause briefly and then
issue another ARREAD. That call will return either a new audit record (if available)
or an ARE-END-OF-AUDIT message. If the call returns a new audit record, issue