XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 4. Generating Reports Using XRM
XYPRO Technology Corporation 91 Proprietary and Confidential
You can limit a report to one or more specific objects by entering the object name(s) in
a comma-separated list.
Note: There must not be any spaces before or after the comma.
Example 1 finds all audit entries with the process $XSR as the object name.
Example 1: $XSR
Example 2 finds all audit entries with the process $XSR and $XYOP as the object
names.
Example 2: $XSR,$XYOP
You may also exclude specific objects with NOT statements. NOT Statements must
follow the initial object name selection. For example, if you want to report on the
accesses to all files on $SYSTEM.SYSTEM, except the EDIT program, you would enter
$SYSTEM.SYSTEM. NOT $SYSTEM.SYSTEM.EDIT.
You may exclude multiple objects by entering the object names you wish to exclude
separated by commas. Example 3 finds all audit entries files in $SYSTEM.SYSTEM
except EDIT and FUP.
Example 3: $SYSTEM.SYSTEM. NOT $SYSTEM.SYSTEM.EDIT,$SYSTEM.SYSTEM.FUP
4.10 Select by Operation
You may limit your report to only certain operations, such as PURGE or REVOKE. You
may string together multiple operations by separating them with commas. The entry is
not case sensitive.
Example:
Operation < >?license,progid
The above Example finds all audit entries with an OPERATION of either LICENSE or
PROGID.
The default is for all operations. To select the operation(s) to include in the report,
select I.
Example:
Selection? I
Enter operation names separated by commas.
A leading * on an operation will match any operations that contain the specified
string. A trailing * will match any operations that start with the specified
string.
The NOT keyword can be used: <operation list> NOT <operation list>
Operation < >?READ
When the Report Selection screen reappears, the selection you entered will be shown:
I: Operation :READ