XMA: AUDIT.MESSAGEID Field Values and Descriptions for Safeguard records

XMA: AUDIT.MESSAGEID Field Values and Descriptions for Safeguard records

Field Values and descriptions for AUDIT.MESSAGEID


Excerpt from HPE Safeguard DDL:
 
From $SYSTEM.ZSPIDEF.ZSFGDDL

2319 CONSTANT zSFG-val-aud-rec-header VALUE 50.
2320 CONSTANT zSFG-val-aud-rec-primary VALUE 51.
2321 CONSTANT zSFG-val-aud-rec-other VALUE 52.
2322 CONSTANT zSFG-val-aud-rec-new VALUE 53.
2323 CONSTANT zSFG-val-aud-rec-before VALUE 54.
2324 CONSTANT zSFG-val-aud-rec-after VALUE 55.
2325 CONSTANT zSFG-val-aud-rec-delete VALUE 56.
2326 CONSTANT zSFG-val-aud-rec-auth VALUE 57.


MESSAGEID:  DESCRIPTION
 
51:  Primary This record has useful info for just about everything except changes to user and object Protection Records. If you want to alert on the record that shows the parameter that was changed, use the 55 (after) records.
 
52:  Secondary All DISKFILE-PATTERN-related info goes in this record. Use this MessageID to Filter out the uninformative secondary records. Everything you need to report or alert on is contained in the Primary.
 
53:  Secondary add/create. When you add a User or Protection Record, Safeguard generates one 53 record per field in the Record. So when you add a user, for example, there will be many type-53 secondary records. If you just want to know that a User or Protection Record was added, select the (51) Primary Record.
 
54:  Secondary This is the ?Before? secondary record of changes to a Protection or User Record. XMA combines this with the ?after? (55) so that all the useful information is contained in a single record: "Password History 2 to 10"
 
55:  Secondary This is the ?After? record of changes to a Protection or User record. It is suppressed by XMA and combined with the ?After? (55) record so that all the useful information is contained in a single record. This record type is also used for LOGOFFs and the new filename for the RENAME operation. This record type is also used for the Subject-Creator information when the ?working? userid is different from the SUBJECT userid (PROGID?d programs, etc).
 
56:  Secondary Delete ? there will be a 56 record for each individual field in the record that was deleted. If you just want to know that a User or Protection Record was deleted, select the (51) Primary Record.
 
57:  Secondary Authentication-related secondary records.



If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.