From 4b0f92b147fb6b4c48f4303b15c3cc1da23dfc23 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 17:15:27 +1000 Subject: [PATCH 1/5] Add audit selection group, audit report and event logger setup to CI-Eng-Sample Co-Authored-By: Claude Opus 5.5 --- examples/CI-Eng-Sample/19_audit_df.qli | 42 +++++++++++++++++++ examples/CI-Eng-Sample/79_remove_audit_df.qli | 19 +++++++++ examples/CI-Eng-Sample/README.md | 25 ++++++++++- examples/CI-Eng-Sample/audit/adtlogci.sup | 11 +++++ examples/CI-Eng-Sample/load.cmd | 2 + examples/CI-Eng-Sample/remove.cmd | 3 +- 6 files changed, 99 insertions(+), 3 deletions(-) create mode 100644 examples/CI-Eng-Sample/19_audit_df.qli create mode 100644 examples/CI-Eng-Sample/79_remove_audit_df.qli create mode 100644 examples/CI-Eng-Sample/audit/adtlogci.sup diff --git a/examples/CI-Eng-Sample/19_audit_df.qli b/examples/CI-Eng-Sample/19_audit_df.qli new file mode 100644 index 0000000..233c0be --- /dev/null +++ b/examples/CI-Eng-Sample/19_audit_df.qli @@ -0,0 +1,42 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! CI-Eng-Sample audit trail examples, CI Server R1.03.00. Load after 18_report_df. +! CIENG_ITEMS : AUDIT Service selection group = events on CI-Eng-Sample objects. Expressions +! have no LIKE: a name prefix is matched with >= "CI-Eng-Sample." and +! < "CI-Eng-Sample/" ('/' sorts right after '.'). COMPILE 1 compiles on load; +! the result is in LISTING and VALID_EXPRESSION. +! CIENG_AUDIT : ad-hoc report of the audit events on CI-Eng-Sample of the last hour. +@FIELDS +NAME,DESCRIPTION,EXPRESSION,COMPILE + +@AUDIT_SELGRP_DF +"CIENG_ITEMS","Audit events on CI-Eng-Sample",@" +sbid >= "CI-Eng-Sample." and sbid < "CI-Eng-Sample/" +"@,1 + +@FIELDS +NAME,DESCRIPTION,PRIORITY,ADHOC_ENABLED,LIFE_TIME,ADHOC_DEST,QUERY + +@REPORT_DF +"CIENG_AUDIT","CI-Eng-Sample audit trail, last hour",0,1,"1 Weeks","CIENG_FILE",@" +/* Who changed what on CI-Eng-Sample in the last hour */ +set @width 160; +column t as 'DD-MM-YYYY hh:mm:ss' heading 'Time'; +column grp as 'A12' heading 'Subject'; +column attr as 'A16' heading 'Attribute'; +column act as 'A8' heading 'Action'; +column src as 'A12' heading 'Source'; +column id as 'A32' heading 'Name'; +column usr as 'A18' heading 'User'; +column ov as 'A12' heading 'Old'; +column nv as 'A12' heading 'New'; +select action_time t, subject_group grp, subject_attribute attr, subject_action act, + subject_source src, subject_ident id, user_name usr, old_value ov, new_value nv + from audit_trail + where action_time > @date - 3600 and subject_ident like 'CI-Eng-Sample.%' + order by action_time; +"@ diff --git a/examples/CI-Eng-Sample/79_remove_audit_df.qli b/examples/CI-Eng-Sample/79_remove_audit_df.qli new file mode 100644 index 0000000..30b7119 --- /dev/null +++ b/examples/CI-Eng-Sample/79_remove_audit_df.qli @@ -0,0 +1,19 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove the CI-Eng-Sample audit report and selection group. Audit trail records themselves +! cannot be deleted (only whole units of storage group ADT, HISTORY Service). +@FIELDS +NAME + +@REPORT_DF +"CIENG_AUDIT" + +@FIELDS +NAME + +@AUDIT_SELGRP_DF +"CIENG_ITEMS" diff --git a/examples/CI-Eng-Sample/README.md b/examples/CI-Eng-Sample/README.md index 6f822ed..ea5b7a3 100644 --- a/examples/CI-Eng-Sample/README.md +++ b/examples/CI-Eng-Sample/README.md @@ -77,6 +77,8 @@ cmd /c "\examples\CI-Eng-Sample\remove.cmd" | `CIENG_TANK1` | Report | Values of the `TANK1` items + last-hour statistics of one item (ad-hoc parameter chosen in an item browser, default `LEVEL`); daily 06:00 local time and ad hoc; output `CIENG_FILE`; lifetime 1 week | | `CIENG_INFLOW_HI` | Report | Generated 5 s after `TANK1.INFLOW` rises above 400; output `CIENG_FILE` | | `CIENG_HTML` | Report | Ad hoc; `TANK1` values as an HTML table (cursor loop) plus the logbook text | +| `CIENG_AUDIT` | Report | Ad hoc; audit trail events on `CI-Eng-Sample.*` of the last hour | +| `CIENG_ITEMS` | Audit selection group | Expression `sbid >= "CI-Eng-Sample." and sbid < "CI-Eng-Sample/"`, compiled on load | Items created by objects (`TANK1.CALC.VOLUME`, `TANK1.JFLOW.sPerMin`) and their sections are deleted with the objects; they are not in `02_item_df.qli`. @@ -102,9 +104,11 @@ New items start with status 13 (`NOT INIT`) until a value is written. | `16_item_alarm_df.qli` | Switch on alarming for `TANK1.LEVEL` (loaded with `dssqld -m`) | | `17_printer_df.tpl`, `17_printer_df.ps1` | Report file device and destination; the script fills in this system's node name and `%TLS_LST_PATH%` and writes `17_printer_df.qli` (not in the repo) | | `18_report_df.qli` | Reports (`REPORT_DF`, RQL in the `QUERY` memo) | +| `19_audit_df.qli` | Audit selection group (`AUDIT_SELGRP_DF`) and audit report | +| `audit/adtlogci.sup` | Setup file for an extra audit event logger `ADTLOGCI` filtered on `CIENG_ITEMS` (copied to `tls\sup` by an administrator, not by `load.cmd`) | | `83a_stop_report_df.qli` | Clears the schedule of `CIENG_TANK1` before removal (a scheduled report cannot be deleted) | | `equipment/eqpciengslv_start.cmd`, `_stop.cmd` | Start/stop the Modbus slave mirror (copy to `tls\com`) | -| `76_`…`93_remove_*.qli` | Names to delete, in reverse order (reports and printer `83`/`84` first, alarm definitions last, `93`) | +| `76_`…`93_remove_*.qli` | Names to delete, in reverse order (audit `79`, reports and printer `83`/`84` first, alarm definitions last, `93`) | | `load.cmd`, `remove.cmd` | Run the steps in the right order | | `displays/CIENG_Tank.xml` | Display (HTML mode): title, number field on `TANK1.LEVEL`, alarm overview, trend of `TANK1.LEVEL`, button *Operator layout* | | `displays/CIENG_Menu.xml` | Navigation display (200 x 700): *Tank 1*, *Current Alarm* (main frame), *Tank 1 popup* (layout `popup`) | @@ -185,7 +189,8 @@ gets its own storage group of type *Report*. Try them (skill `reporting`, task ` - Ad hoc: `REPORT_DF` `NAME,PARAM_VALUE_1,GENERATE` = `"CIENG_TANK1","CI-Eng-Sample.TANK1.INFLOW",1` with `dssqld -m`, or in the Engineering Module *Configuration > Reporting > Reports* › right-click - › *Generate*. The output lands in `%TLS_LST_PATH%\cieng_report.txt` and in `REPORT_VAL`. + › *Generate*. The output lands in `REPORT_VAL`; runs from the Engineering Module also print to + `%TLS_LST_PATH%\cieng_report.txt` (runs from `dssqld` do not print, ISS-045). - Trigger: `itmval -p -n CI-Eng-Sample.TANK1.INFLOW -v 450` → `CIENG_INFLOW_HI` 5 s later; write a value below 400 before the next test. - `CIENG_TANK1` also runs every day at 06:00 (local time). @@ -193,6 +198,22 @@ gets its own storage group of type *Report*. Try them (skill `reporting`, task ` `remove.cmd` clears the schedule, removes the reports (with their generated reports and logbook files), the destination and device, and deletes `cieng_report.txt`. +## Audit trail + +No admin rights needed for `19_audit_df.qli`. Every change made by `load.cmd`, `dssqld` or the +Engineering Module is in the audit trail (skill `audit-trail`): + +- Generate `CIENG_AUDIT` (ad hoc, like the other reports) to list the last hour of changes on + `CI-Eng-Sample.*`: time, dataset, field, action, source, user, old and new value. +- Export: `dssqld -e audit.qlo -d AUDIT_TRAIL` (whole trail) or a qli with `@SELECT` (keep `NAME` + in `@FIELDS`). +- Event logger (optional, admin): copy `audit\adtlogci.sup` to `%TLS_ROOT_PATH%\tls\sup\`, then + run `adtlog -n adtlogci` in a console; it prints each new CI-Eng-Sample event on one line + (Ctrl+C to stop). Delete the file from `tls\sup` when the sample is removed. + +Audit records themselves cannot be deleted; `remove.cmd` removes only the report and the +selection group. + ## Planned additions | Phase | Adds | diff --git a/examples/CI-Eng-Sample/audit/adtlogci.sup b/examples/CI-Eng-Sample/audit/adtlogci.sup new file mode 100644 index 0000000..ef1a703 --- /dev/null +++ b/examples/CI-Eng-Sample/audit/adtlogci.sup @@ -0,0 +1,11 @@ +! CI-Eng-Sample: setup file for an extra AUDIT Service event logger (ADTLOG) named ADTLOGCI. +! A setup file is named after the process; copy this file to %TLS_ROOT_PATH%\tls\sup (admin) +! and start the logger with: adtlog -n adtlogci +! It prints only events of selection group CIENG_ITEMS (load 19_audit_df.qli first; the +! group must have compiled, else the logger exits). Output goes to stdout (no PRT_DEV). +! Keywords: see adtsys.sup (template) and knowledge/manuals/IM36K10L25-01EN.md. +SEL_GROUP = "CIENG_ITEMS" +TIMEFMT = "DD-MM-YYYY hh:mm:ss" +E_LAYOUT = ACTM,19,SBGP,12,SATR,14,SACT,8,SACS,12,SBID,32,USER,18,OVAL,12,NVAL,12 +HEADER = "Time Subject Attribute Action Source Name User Old New" +HEADER_AFTER = 20 diff --git a/examples/CI-Eng-Sample/load.cmd b/examples/CI-Eng-Sample/load.cmd index c8f2dac..a8012d9 100644 --- a/examples/CI-Eng-Sample/load.cmd +++ b/examples/CI-Eng-Sample/load.cmd @@ -42,3 +42,5 @@ rem from 17_printer_df.tpl), then the report definitions. powershell -NoProfile -ExecutionPolicy Bypass -File 17_printer_df.ps1 dssqld -i 17_printer_df.qli -l 17_printer_df.qlo dssqld -i 18_report_df.qli -l 18_report_df.qlo +rem Audit trail: selection group (compiled on load) and an ad-hoc audit report. +dssqld -i 19_audit_df.qli -l 19_audit_df.qlo diff --git a/examples/CI-Eng-Sample/remove.cmd b/examples/CI-Eng-Sample/remove.cmd index 9ccce96..3fd02aa 100644 --- a/examples/CI-Eng-Sample/remove.cmd +++ b/examples/CI-Eng-Sample/remove.cmd @@ -1,10 +1,11 @@ @echo off rem Remove CI-Eng-Sample from a CI Server R1.03 TEST system (also deletes its history). rem Run in an elevated prompt while CI Server is running; call this script by full path. -rem Order: reports, printer, OPC UA, Modbus, auth group, object, class, trigger group, storage links, stop + delete storage groups, items, sections (children first). +rem Order: audit report + selection group, reports, printer, OPC UA, Modbus, auth group, object, class, trigger group, storage links, stop + delete storage groups, items, sections (children first). rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the rem group first gets a stop time one minute ahead; the script waits until it has passed. cd /d "%~dp0" +dssqld -r 79_remove_audit_df.qli -l 79_remove_audit_df.qlo rem Reports first (they refer to TANK1.INFLOW and the destination), then destination and device. rem A scheduled report cannot be deleted, so its schedule is cleared first. dssqld -m 83a_stop_report_df.qli -l 83a_stop_report_df.qlo -- 2.45.3 From cfc48a888d1503294730aa6686c86cf3bcd1fcd1 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 17:15:27 +1000 Subject: [PATCH 2/5] Add audit-trail skill Co-Authored-By: Claude Opus 5.5 --- .claude/skills/audit-trail/SKILL.md | 39 +++++++ .../skills/audit-trail/tasks/audit-checks.md | 59 ++++++++++ .../audit-trail/tasks/configure-audit.md | 108 ++++++++++++++++++ .../audit-trail/tasks/read-audit-trail.md | 85 ++++++++++++++ 4 files changed, 291 insertions(+) create mode 100644 .claude/skills/audit-trail/SKILL.md create mode 100644 .claude/skills/audit-trail/tasks/audit-checks.md create mode 100644 .claude/skills/audit-trail/tasks/configure-audit.md create mode 100644 .claude/skills/audit-trail/tasks/read-audit-trail.md diff --git a/.claude/skills/audit-trail/SKILL.md b/.claude/skills/audit-trail/SKILL.md new file mode 100644 index 0000000..1f4033d --- /dev/null +++ b/.claude/skills/audit-trail/SKILL.md @@ -0,0 +1,39 @@ +--- +name: audit-trail +description: >- + CI Server R1.03 AUDIT Service and audit trail. Use when the user wants to know who changed + what and when (item value written, limit or description changed, item / section / object / + report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read + or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user, + source HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / ODBC / QUICKLOAD), make an audit + report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF, + STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection + groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events + (ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol, + adtdst, audit_start), or change how long the audit trail is kept (ADT lifetime). Source + IM 36K10L25-01EN. +--- + +# Audit trail (R1.03) + +Background: `knowledge/manuals/IM36K10L25-01EN.md` (processes, classifiers, setup keywords, +installed findings), `IM36K10G10-01EN.md` ch. 9 (overview), `IM36K10C40-01EN.md` (storage groups), +`IM36K10P20-01EN.md` (RQL for audit reports). + +Rules: +- Run `system-check` first; follow the user's chosen way of working. +- The audit trail is evidence: single records cannot be deleted, and nothing in these tasks + deletes them. Changing the `ADT` storage group (lifetime, stop, delete units) loses history — + only with the user's explicit approval (skill `history-management`). +- Switching a classifier's `STORAGE` off stops recording that event type: confirm with the user. +- Setup files in `tls\sup` (`adtsys.sup`, per-process files) need admin rights: hand them to + the user (skill `portal-setup`, `change-setup-file.md`). +- Example names come from `CI-Eng-Sample` (selection group `CIENG_ITEMS`, report `CIENG_AUDIT`, + logger setup file `audit/adtlogci.sup`). + +| Task | File | Status | +|---|---|---| +| Check AUDIT Service: processes, storage group `ADT`, classifier and selection group counts | `tasks/audit-checks.md` | verified | +| Read the audit trail: export, RQL query, audit report, what gets recorded by which tool | `tasks/read-audit-trail.md` | verified | +| Choose what is stored (classifier `STORAGE`), selection groups, event logger `ADTLOG` | `tasks/configure-audit.md` | verified (operator-side item value events from docs, ISS-049) | +| Distributor process, extra collectors, new classifier entities in C | L25 summary §2, §5 | from docs | diff --git a/.claude/skills/audit-trail/tasks/audit-checks.md b/.claude/skills/audit-trail/tasks/audit-checks.md new file mode 100644 index 0000000..ede64c6 --- /dev/null +++ b/.claude/skills/audit-trail/tasks/audit-checks.md @@ -0,0 +1,59 @@ +--- +task: Check AUDIT Service (processes, storage group ADT, classifiers, selection groups) +version: R1.03 +source: IM 36K10L25-01EN §1.2, §2.1.1, §2.3.1, §4.1; practiced on the test system 2026-10-01 +status: verified +--- + +# AUDIT Service checks + +All read-only. + +## 1. Processes + +``` +tasklist /FI "IMAGENAME eq adt*" +durwfp -p adtsto -t 0 (errorlevel 0 = running) +``` + +Default (`tls\com\audit_start.cmd`): `adtsto.exe` (storage, process `ADTSTO`) and `adtcol.exe` +(collector `ADTCOL01`). AUDIT Service starts after HISTORY Service and refuses to start when +`his` is not running; `ADTCOL01` exits if storage group `ADT` does not exist (first start: +`ADTSTO` creates it). `adtdst` (distributor), `adtlog` (event logger) and `adtcol02` are only in +commented lines. Stop: `audit_stop.cmd` (`durstp` on `adt*`, admin). + +## 2. Storage group `ADT` + +``` +@FIELDS +NAME,LIFE_TIME,ROLLOVER_INT,START_TIME,STOP_TIME,TYPE +@SELECT +'NAME = "ADT"' +@HIS_GROUP_DF +``` + +`dssqld -e adt.qlo adt.qli`. History type 6 (audit). Manual default when `ADTSTO` creates it: +rollover 1 day, unit lifetime 2 days; the test system had **52 weeks** lifetime, rollover +1 day. While storage of `ADT` is stopped, new events are refused (logged via UMH). Unit +details: skill `history-management`, `history-checks.md`. + +## 3. Classifiers and selection groups + +``` +dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF +dssqld -e sgp.qlo -d AUDIT_SELGRP_DF +``` + +R1.03.00 test system: 463 classifiers (`BASIC_SET` 1), 444 with `STORAGE` 1. Off by default: +everything from source `COMPUTE` (PROCESS Service) on `ITEM`/`SUB-ITEM` values, status, +quality, limits and deadband, and `DATASET.NULL-ATTR.*.COMPUTE`. No selection groups exist +until you create one (the file `tls\dat\adt_sgp.dat` is created empty by `ADTSTO`). + +Files: `%TLS_DAT_PATH%\adt_ecl.*` (classifiers), `adt_sgp.*` (selection groups); audit records +are in the history files of group `ADT` (`%TLS_HIS_PATH%`). + +## 4. Setup files + +Only `tls\sup\adtsys.sup` is installed (`QUESIZE = 200`, the rest commented): it is the keyword +reference and template. A process reads a setup file named after itself (`adtsto.sup`, +`adtcol01.sup`, `adtlog.sup` …) if present. Keywords: `configure-audit.md` §4 and the L25 summary. diff --git a/.claude/skills/audit-trail/tasks/configure-audit.md b/.claude/skills/audit-trail/tasks/configure-audit.md new file mode 100644 index 0000000..c9da17f --- /dev/null +++ b/.claude/skills/audit-trail/tasks/configure-audit.md @@ -0,0 +1,108 @@ +--- +task: Choose what AUDIT Service stores (classifier STORAGE, AUDIT_INFO), define selection groups, run an event logger (ADTLOG) +version: R1.03 +source: IM 36K10L25-01EN §2.4, §3, §4.2, App. 1; practiced on CI-Eng-Sample 2026-10-01 +status: verified (operator-side ITEM.* value events from docs, ISS-049) +--- + +# Configure the audit trail + +## 1. Event classifiers — what is stored + +Each event type is a classifier `...` in +`AUDIT_EVENT_CLAS_DF` (`NAME`, `SUBJECT`, `ATTRIBUTE`, `AGITATION` = action, `SOURCE`, +`BASIC_SET`, `STORAGE`). Only `STORAGE` can be changed. Configuration and DSS value changes use +subject `DATASET` with attribute `NULL-ATTR`, e.g. `DATASET.NULL-ATTR.MODIFY.LOC-ENG-MOD` +(Engineering Module) or `….ENT-ENG-MOD` (`dssqld`); logins use `CI-SERVER.NULL-ATTR.LOGIN.`. + +List the classifiers (and which are off): `dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF`. Change: + +``` +@FIELDS +NAME,STORAGE +@AUDIT_EVENT_CLAS_DF +"...",0 +``` + +`dssqld -m` (the change itself is audited: `AUDIT_EVENT_CLAS_DF` `STORAGE` `MODIFY`). +**Not immediate:** the processes that report events (e.g. `DSSSDA`) cache the storage flags and +re-read them every `ECL_REFRESH` seconds (default 1800). In the test a switched-off classifier was +still recorded right after the change (ISS-050). Confirm with the user before +switching anything off. + +### Item option *Audit trailing wanted* (`AUDIT_INFO`) + +`ITEM_DF` / `SUB_ITEM_DF` / `EXTERNAL_ALARM_DF` field `AUDIT_INFO` (default 0). It did **not** +change what the tested tools record: DSS and Engineering Module value writes are audited for all +items, `itmval -p` for none. It is meant for the `ITEM.*` / `SUB-ITEM.*` classifiers (value, +status, limits) raised by ITEM Service for operator and PROCESS writes; PROCESS (`COMPUTE`) also +needs `AUDIT = YES` in `tls\sup\opc.sup` (installed `NO`) and its classifiers are off by default. +Not verified (ISS-049). + +## 2. Selection groups + +A selection group is a named, compiled filter for an AUDIT destination (`ADTLOG`, the +chronological overview). Dataset `AUDIT_SELGRP_DF`: `NAME` (≤ 32), `DESCRIPTION`, `EXPRESSION` +(memo), `COMPILE` (1 = compile now), `LISTING` (compiler output), `VALID_EXPRESSION`. + +Expression language (from the compiler's own listing): +- Words compared with a **string**: `aai1 acnd acnm actm mai1 nond nonm reas sacs sact satr sbgp + sbid term user` (same meaning as the `E_LAYOUT` units in §4: `sbgp` subject, `satr` attribute, + `sact` action, `sacs` source, `sbid` subject id, `user` …). +- Words compared with a constant: `nval oval` (new / old value). +- Operators `= != > < >= <=`, `and`, `or`, parentheses. **No `LIKE`**: match a name prefix with a + range, e.g. `sbid >= "
." and sbid < "
/"` (`/` sorts right after `.`). + +Example (`examples/CI-Eng-Sample/19_audit_df.qli`): + +``` +@FIELDS +NAME,DESCRIPTION,EXPRESSION,COMPILE +@AUDIT_SELGRP_DF +"CIENG_ITEMS","Audit events on CI-Eng-Sample",@" +sbid >= "CI-Eng-Sample." and sbid < "CI-Eng-Sample/" +"@,1 +``` + +`dssqld -i`. Write the memo **over several lines** (`@"` newline … newline `"@`): on one line +`@""@` is taken as a file name (`CRL-E-EINVAL` / `CRL-E-ENOENT`). Check: export the dataset +— `LISTING` ends with `ADTT-I-CMP_SUCC, Expression successfully compiled` and +`VALID_EXPRESSION` is 1. An error (e.g. `ADTT-E-UNKNOWN_TOK`) makes the `dssqld` line fail with +`ADTT-E-CMP_NO_SUCC` and leaves `VALID_EXPRESSION` 0. Remove with `dssqld -r` (`NAME` only). + +## 3. Event logger `ADTLOG` + +`adtlog -n ` connects to `ADTSTO` and prints each new event as text (stdout, or the +printer in `PRT_DEV`). It is not started by default (`audit_start.cmd` has it commented out; +`fmfprt.sup` assigns the printer function `AUDIT_TRAIL` to `ADTLOG`). A process reads +`tls\sup\.sup`, so one setup file per logger instance. + +Without a setup file the default layout is three lines per event (time with milliseconds, +subject, attribute, action, source / subject id, user / old and new value). Verified test: +`adtlog -n adtlogt` in a console, then a value write — the logger printed the `LOGIN`, the +`ITEM_VAL` change and the `LOGOUT`. A console logger runs until stopped: Ctrl+C, or `durstp -m -p ` (skill +`system-management`, `bus-utilities.md`). + +Filtered logger: `examples/CI-Eng-Sample/audit/adtlogci.sup` (`SEL_GROUP = "CIENG_ITEMS"`, one-line +`E_LAYOUT`, `TIMEFMT`, `HEADER`, `HEADER_AFTER`). The user copies it to +`%TLS_ROOT_PATH%\tls\sup\` (admin); then `adtlog -n adtlogci` printed only the CI-Eng-Sample +changes (no logins), one line each under the header. If the selection group does not exist or +did not compile, the logger logs an error and exits. To run it permanently, add a +`start /B /NORMAL %TLS_ROOT_PATH%\tls\exe\adtlog -n ` line to `audit_start.cmd` (admin, +restart). + +## 4. Setup keywords (`adtsys.sup` is the template) + +`MAX_OPEN_UNITS` (20), `PRT_DEV`, `QUESIZE` (kB), `SEL_GROUP`; `COL_PROC`, `DST_PROC`, `HIS_PROC`, +`STO_PROC` = `, `; `NODE_ECL_FILE`, `NODE_SGP_FILE`; `E_LAYOUT = ,,…` +(`AAI1 ACND ACNM ACTM MAI1 NOND NONM NOTM NVAL NWLN OVAL REAS SACS SACT SATR SBGP SBID SPCE TERM +USER`), `E_NOSPACE`, `TIMEFMT` (`DD/MM/YY hh:mm:ss.ppp` default — milliseconds shown, as the +manual says); `ECL_REFRESH` (1800 s), `FLOWC` (30, 10), `HBEAT` (10), `TRYCON` (10); `FORM_FEED`, +`HEADER` (repeat for more lines), `HEADER_AFTER` (re-print after n events; the header is also +printed once at start). Which keyword applies to which process: L25 §4.2.2. + +## 5. Retention + +Audit records live in history storage group `ADT` (rollover 1 day; lifetime 52 weeks on the +test system). Longer/shorter retention = change `LIFE_TIME` of `ADT` (skill +`history-management`); archive like any storage group. Ask before shortening it. diff --git a/.claude/skills/audit-trail/tasks/read-audit-trail.md b/.claude/skills/audit-trail/tasks/read-audit-trail.md new file mode 100644 index 0000000..7c9f990 --- /dev/null +++ b/.claude/skills/audit-trail/tasks/read-audit-trail.md @@ -0,0 +1,85 @@ +--- +task: Read the audit trail (export, RQL query, audit report) and know what each tool records +version: R1.03 +source: IM 36K10L25-01EN §1.1, §2.1.2, §3.1, App. 1; IM 36K10G10-01EN ch. 9; practiced on CI-Eng-Sample 2026-10-01 +status: verified +--- + +# Read the audit trail + +Read-only. Dataset `AUDIT_TRAIL` (storage group `ADT`); every field is read-only except +`APPLICATION_SUB` (the "modifiable ASCII application info") and `PROFILE`. + +## 1. Fields + +| Field | Content | +|---|---| +| `NAME` | `/`, e.g. `01-OCT-26 17:05:00.181/84` | +| `ACTION_TIME`, `NOTIFICATION_TIME`, `MODIFICATION_TIME` | When it happened / reached AUDIT Service / `APPLICATION_SUB` was last changed | +| `SUBJECT_GROUP` | Subject: the **dataset name** for configuration and DSS value changes (`ITEM_DF`, `ITEM_VAL`, `SECTION_DF`, `REPORT_DF`, `AUDIT_EVENT_CLAS_DF` …) or a classifier subject (`CI-SERVER` for logins, `ITEM`, `SUB-ITEM` …) | +| `SUBJECT_ATTRIBUTE` | Changed field (`HIGH_LIMIT`, `ITEM_VALUE`, `DESCRIPTION` …); empty for insert/delete/login | +| `SUBJECT_ACTION` | `INSERT`, `MODIFY`, `DELETE`, `LOGIN`, `LOGOUT`, `LOGIN-ATTEMPT`, `ACKNOWLEDGE`, `SHELVE`, `UN-SHELVE` | +| `SUBJECT_SOURCE` | Tool that made the change (table in §2) | +| `SUBJECT_IDENT` | Record name: item, section, object (`:` for attribute values) … | +| `USER_NAME`, `PROFILE`, `TERMINAL` | CI Server user and profile; terminal often empty | +| `ACTION_NODE`/`ACTION_PROCESS`, `NOTIFICATION_NODE`/`NOTIFICATION_PROCESS` | Node and process (`DSSSDA00`, `JHMISET1086`, `DSSQLD00875` …) | +| `OLD_VALUE`, `NEW_VALUE` | Text, max 64 characters (longer values are cut) | +| `REASON`, `APPLICATION_INFO`, `APPLICATION_SUB` | Free text from the notifying program (empty in the tests) | + +## 2. What is recorded (verified on R1.03.00) + +| Action | Recorded as | +|---|---| +| `dssqld` load / modify / remove (any dataset) | ``, field, `INSERT`/`MODIFY`/`DELETE`, source **`ENT-ENG-MOD`**, user `FULL AUTHORIZATION`, plus a `CI-SERVER` `LOGIN`/`LOGOUT` pair per `dssqld` run (not `QUICKLOAD`) | +| Writing a value through DSS (`dssqld -m` on `ITEM_VAL`) | `ITEM_VAL` `ITEM_VALUE` `MODIFY`, old and new value — for **every** item, whatever its *Audit trailing wanted* (`AUDIT_INFO`) | +| Engineering Module: change an item field | `ITEM_DF` `` `MODIFY`, source `LOC-ENG-MOD`, user `ADMIN` (the logged-in user) | +| Engineering Module: right-click item › *Update value* | `ITEM_VAL` `ITEM_VALUE_STR` `MODIFY` (old/new) and `ITEM_VAL` `STATUS` `MODIFY`, source `LOC-ENG-MOD` | +| Engineering Module / Operator / OPC UA server login | `CI-SERVER` `LOGIN` / `LOGOUT`, source `LOC-ENG-MOD`, `OPER-INTERFACE`, `VIA-OPC-UAS` | +| `itmval -p` (ITEM Service API) | **nothing**, even with `AUDIT_INFO` 1 | + +The `ITEM.VALUE.MODIFY.*` style classifiers (subject `ITEM`) were not produced by any of these +tools; they are expected from operator displays and PROCESS Service on items with +`AUDIT_INFO` 1 (open: ISS-049). The `SUBJECT_SOURCE` of a user interface comes from its *audit +trail id* in `dssana.sup` `USER_INTERFACE` (Engineering Module = `LOC-ENG-MOD`). + +## 3. Export + +`dssqld -e` skips `AUDIT_TRAIL` in a full export (`NO-EXPORT` in `dssqld.sup`); name it: + +``` +dssqld -e audit.qlo -d AUDIT_TRAIL +``` + +or filter (dates as `dd-mm-yyyy hh:mm:ss`, local time): + +``` +@FIELDS +NAME,SUBJECT_GROUP,SUBJECT_ATTRIBUTE,SUBJECT_ACTION,SUBJECT_SOURCE,SUBJECT_IDENT,USER_NAME,OLD_VALUE,NEW_VALUE +@SELECT +'SUBJECT_IDENT = "
." AND ACTION_TIME > "01-10-2026 17:00:00"' +@AUDIT_TRAIL +``` + +`dssqld -e out.csv audit.qli -c` (CSV). **Keep `NAME` in `@FIELDS`**: without the key field the +export silently returns 0 records (verified). The whole trail can be large (5 000 records after a +year of test work). Wildcards: `SUBJECT_IDENT LIKE "
.*"` (`*`, not `%`; `=` with `*` +matches nothing). + +## 4. RQL query and audit report + +``` +column t as 'DD-MM-YYYY hh:mm:ss' heading 'Time'; +select action_time t, subject_group, subject_attribute, subject_action, subject_source, + subject_ident, user_name, old_value, new_value + from audit_trail + where action_time > @date - 3600 and subject_ident like '
.%' + order by action_time; +``` + +Use aliases with `COLUMN … AS 'A12'` to keep lines short (the fields are 16–256 characters +wide). Try it in the interactive generator (skill `reporting`, `rql-interactive.md`). The sample +report `CIENG_AUDIT` (`examples/CI-Eng-Sample/19_audit_df.qli`) lists the last hour of events on +`CI-Eng-Sample.*`; generate it like any ad-hoc report (`define-reports.md` §2). Generated from +`dssqld` it is stored but not printed (`FSL-E-PRT_UNKUSER`, ISS-045). + +The Engineering Module also has the system report `AUDIT_TRAIL` (IM 36K10C30 App. 1). -- 2.45.3 From f1bff6dea65c1b1a2afd57c378586a05d8f2d4c6 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 17:15:27 +1000 Subject: [PATCH 3/5] Record phase 12 manual, progress and issues ISS-049 to ISS-051 Co-Authored-By: Claude Opus 5.5 --- knowledge/issues.md | 3 + knowledge/manuals/IM36K10G10-01EN.md | 4 +- knowledge/manuals/IM36K10L25-01EN.md | 144 +++++++++++++++++++++++++++ knowledge/progress.md | 7 +- 4 files changed, 155 insertions(+), 3 deletions(-) create mode 100644 knowledge/manuals/IM36K10L25-01EN.md diff --git a/knowledge/issues.md b/knowledge/issues.md index 00bed27..92dd5da 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -68,3 +68,6 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-046 | 2026-10-01 | DATABASE (`dssqld` memo) | A memo field loaded from a file (`@""@`, IM 36K10L50 §3.10) fails with a relative name (`CRL-E-ENOENT`, the file is read on the server side) and with a long absolute path (`DSSG-E-STRBUFSMAL`, buffer 83); a short absolute path works. The manual gives no limits. | open | Documented: use inline memos, or an absolute path ≤ 82 characters. Close when the user confirms. | `.claude/skills/system-management/tasks/dss-tools.md` §2; `knowledge/manuals/IM36K10L50-01EN.md` §4 | | ISS-047 | 2026-10-01 | REPORT (RQL manuals) | The manuals disagree: default `@WORKSPACE` 500 KB (IM 36K10R40 §2.2.2) vs 16 KB (IM 36K10C30 table 2.1-1, IM 36K10P20 §9.6); maximum `@WIDTH` 512 (R40, P20 §4) vs 5000 (P20 §9.6); `@FORMFEED` described with opposite meanings (C30: not 1 = form feed; P20: 0 = blank lines, default 1). Installed set-up files set `@workspace` explicitly (500 in `rptge1.rpt`, 100 in `rptgen.rpt`) and `@formfeed 0` for the interactive generator. | open | Not tested (no printer); the set-up files make the defaults irrelevant in practice. | `knowledge/manuals/IM36K10R40-01EN.md` §2; `knowledge/manuals/IM36K10P20-01EN.md` §3 | | ISS-048 | 2026-10-01 | REPORT (ad-hoc parameters) | The prompt `[ITEM:NAME like "CI-Eng-Sample.TANK1.*"]Item for statistics:` (filter form as in IM 36K10C30 §2.1) gives an item tree browser in the Engineering Module generate dialog, but the tree shows all sections, not only `TANK1` items (checked by the user). | open | Try other filter forms (`%` wildcard, `SECTION = …`, `[ITEM:TAG="…"]`) and the display report component. | `.claude/skills/reporting/tasks/define-reports.md`; `knowledge/manuals/IM36K10C30-01EN.md` §2; `examples/CI-Eng-Sample/18_report_df.qli` comment | +| ISS-049 | 2026-10-01 | AUDIT (item option *Audit trailing wanted*) | IM 36K10G10 ch. 9 and the classifier list (IM 36K10L25 App. 1, `ITEM.VALUE.MODIFY.`, `ITEM.HIGH-LIMIT…`) suggest item changes are audited per item when `AUDIT_INFO` = 1. On R1.03.00 none of the tested tools produced an `ITEM.*` event: `itmval -p` writes are not audited at all (with `AUDIT_INFO` 0 or 1); value writes through DSS (`dssqld -m ITEM_VAL`) and Engineering Module *Update value* are audited as dataset events (`ITEM_VAL`, `ITEM_VALUE` / `ITEM_VALUE_STR` / `STATUS`) for every item regardless of `AUDIT_INFO`. Operator-display writes and PROCESS writes (`opc.sup` `AUDIT = YES`, `COMPUTE` classifiers off by default) were not tested (no input field in the sample displays). | open | Test an operator value input on an item with `AUDIT_INFO` 1 (needs a display with an input field) and, if wanted, PROCESS with `AUDIT = YES`. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `.claude/skills/audit-trail/tasks/read-audit-trail.md` §2; `knowledge/manuals/IM36K10L25-01EN.md` §3 | +| ISS-050 | 2026-10-01 | AUDIT (classifier `STORAGE`) | Setting `AUDIT_EVENT_CLAS_DF.STORAGE` = 0 for `DATASET.NULL-ATTR.MODIFY.ENT-ENG-MOD` at 17:01:12 did not stop the next `dssqld -m ITEM_VAL` change from being stored (17:01:12.573). IM 36K10L25 §3.2 explains a per-process cache refreshed every `ECL_REFRESH` s (default 1800); the notifier here is `DSSSDA`, so the change should apply within 30 minutes. | investigating | Re-test after 17:31 on 2026-10-01, then set `STORAGE` back to 1. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `knowledge/manuals/IM36K10L25-01EN.md` §3 | +| ISS-051 | 2026-10-01 | AUDIT (manual vs installed) | Differences between IM 36K10L25 and R1.03.00: (1) App. 1 lists subject `F/T-SYSTEM`, the installed classifiers use `CI-SERVER` (logins) and also `EAL OPERATION` (subject and action) and source `VIA-OPC-UAS`, not in the manual; 463 classifiers installed. (2) App. 1 explanations of `SHELVE` and `UN-SHELVE` are swapped. (3) `QUESIZE`: manual default and maximum 200 kB, `adtsys.sup` help default 10 kB, minimum 10 (file sets 200). (4) `TIMEFMT` default: manual `DD/MM/YY hh:mm:ss.ppp`, `adtsys.sup` help without `.ppp`; `ADTLOG` output shows milliseconds (manual right). (5) `dssqld` changes are recorded with source `ENT-ENG-MOD`, not `QUICKLOAD`. (6) The selection expression language is not described in the manual; the compiler listing gives the words and operators (no `LIKE`). (7) `ADT` group lifetime 52 weeks on the test system vs 2 days default when `ADTSTO` creates it (§2.1.1). | open | Documented in the L25 summary and the `audit-trail` skill. Close when the user confirms. | `knowledge/manuals/IM36K10L25-01EN.md`; `.claude/skills/audit-trail/tasks/*.md` | diff --git a/knowledge/manuals/IM36K10G10-01EN.md b/knowledge/manuals/IM36K10G10-01EN.md index d616f86..552d2cb 100644 --- a/knowledge/manuals/IM36K10G10-01EN.md +++ b/knowledge/manuals/IM36K10G10-01EN.md @@ -88,7 +88,9 @@ on a schedule, or on an item event (with delay). Destinations: `DEFAULT`, `PRINT **Audit trail (ch. 9)**: stored in dataset `AUDIT_TRAIL`, storage group `ADT`; events are named `...`, e.g. `ITEM.VALUE.MODIFY.HMI`; records -cannot be deleted except by deleting storage units. +cannot be deleted except by deleting storage units. On R1.03.00 configuration and DSS changes +are recorded per dataset (e.g. `ITEM_DF.HIGH_LIMIT.MODIFY`); details in `IM36K10L25-01EN.md`, +skill `audit-trail`. **RDBMS exposure (ch. 10)**: copies CI Server data (`ITEM_VALUES` aggregated per interval, `ITEM_HISTORY` with a mandatory filter, `ITEM_INPUTS` for writes back, or any dataset on diff --git a/knowledge/manuals/IM36K10L25-01EN.md b/knowledge/manuals/IM36K10L25-01EN.md new file mode 100644 index 0000000..2c2851f --- /dev/null +++ b/knowledge/manuals/IM36K10L25-01EN.md @@ -0,0 +1,144 @@ +--- +manual: IM 36K10L25-01EN +title: Audit Trail Management Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: processes, scripts, adtsys.sup, classifiers, ADT group, AUDIT_TRAIL contents, selection groups and ADTLOG (default and filtered) verified on the test system 2026-10-01; distributor, extra collectors, classifier extension in C and operator-side ITEM.* events from docs +--- + +# Audit Trail Management Engineering (R1.03) + +AUDIT Service records who changed what and when: value and limit changes, definition inserts / +modifies / deletes, alarm acknowledgements, logins and logouts. Events are stored in the history +storage group `ADT` and read through dataset `AUDIT_TRAIL`. The manual is written for system +integrators (processes, setup file, extending the classifier tables in C). Section numbers refer +to the manual; "installed" means checked on the R1.03.00 test system. + +## 1. Interfaces and data stores (§1) + +| Interface / store | Use | +|---|---| +| Notification | Applications report an event (routine `adt_evt_not`); only one field of a stored event, the *modifiable ASCII application info*, can be changed afterwards | +| Distribution | Connected processes (AUDIT destinations) receive events as they are stored, optionally filtered by a selection group | +| Retrieval | Reading stored events (collector process; `AUDIT_TRAIL` dataset) | +| History management | Storage group `ADT` is managed by HISTORY Service (rollover, lifetime, units) | +| Event classifier file | Which event types exist and whether each is **stored** — dataset `AUDIT_EVENT_CLAS_DF` (`tls\dat\adt_ecl.dat`) | +| Selection group file | Named, compiled selection expressions — dataset `AUDIT_SELGRP_DF` (`tls\dat\adt_sgp.dat`) | + +Single events cannot be deleted; only whole storage units or the whole group (HISTORY Service). + +## 2. Processes (§1.2, §2, §4.1) + +| Process | Job | +|---|---| +| `ADTSTO` (storage) | Creates group `ADT` if missing (rollover 1 day, unit lifetime 2 days), fills the classifier file with the basic set (existing entries kept), creates the selection group file, stores events, sends them to destinations. Ignores events while storage of `ADT` is stopped. Must run on the node of the history manager `HIS` | +| `ADTCOL01` (+ `ADTCOL02`…) | Answers retrieval requests, also while storage is stopped; extra images share the queue `adtcol01` (load sharing). Exits if group `ADT` does not exist, so `ADTSTO` must start first | +| `ADTDST` (distributor) | Optional relay on another node when several destinations there want events (3 + N instead of 3 × N BUS messages) | +| `ADTLOG` (logging) | Optional destination that prints events as text (stdout or `PRT_DEV`), optionally only a selection group | + +Gaps are signalled with *missing events* records/messages (storage queue overflow, lost +connection, unexpected sequence number). Destinations check sequence numbers and periodic +flow-control messages; a missing flow-control message makes them reconnect. + +**Installed:** `tls\com\audit_start.cmd` does nothing if `adtsto` already runs, refuses to start +when `his` is not running, then starts `adtsto -n adtsto` and `adtcol -n adtcol01`. `adtcol02`, +`adtlog` and `adtdst` are present as commented-out lines. `audit_stop.cmd` stops `adt*` with +`durstp`. Executables in `tls\exe`: `adtsto`, `adtcol`, `adtdst`, `adtlog`, `adtimport` +(undocumented), `adtxdb` (service debugger, not documented). + +## 3. Event classifiers (§3.1, Appendix 1) + +An event classifier is four names `...`, e.g. +`ITEM.VALUE.MODIFY.HMI`. Each name has an internal code; stored events keep only the codes, so +codes must never change once used. + +- **Subjects**: ALN-DEST, ALN-USR, CLASS, CLASS-ATTR, DATASET, EQUIPMENT, F/T-SYSTEM, + INSTALLATION, ITEM, OBJECT, OBJECT-ATTR, SECTION, STATION, SUB-ITEM, TRIGGER-GROUP, UNIT, + USER-PROFILE, ACKNOWLEDGE-TYP. +- **Attributes** (about 170): item properties (VALUE, STATUS, HIGH-LIMIT, LOW-LIMIT, DESCRIPTION, + ENGINERING-UNIT, ALARM-INHIBIT, ALARM-SHELVE, ENABLE-AUDIT-TR …), point/line properties, + alarm notification users and schedules, NULL-ATTR (no attribute). +- **Actions**: ACKNOWLEDGE, DELETE, INSERT, LOGIN, LOGIN-ATTEMPT, LOGOUT, MODIFY, SHELVE, + UN-SHELVE (the manual's explanations of SHELVE and UN-SHELVE are swapped). +- **Sources**: COMPUTE (PROCESS Service), DSS-CLIENT, ENT-EDIT-MOD, ENT-ENG-MOD, ENT-QUALIZATION, + FTEXCHANGE, HMI (Engineering Module), LOC-EDIT-MOD, LOC-ENG-MOD, ODBC, OPC-DA-SERVER, + OPER-INTERFACE, OTHERS, QUICKLOAD. + +The notifying routine checks a cached copy of the classifier's **storage** flag and sends +nothing when storage is off; the cache refreshes every `ECL_REFRESH` seconds (default 1800), so +a change to the storage flag may take up to 30 minutes to reach running programs. + +**Installed:** `AUDIT_EVENT_CLAS_DF` fields `NAME` (the four names joined), `SUBJECT`, +`ATTRIBUTE`, `AGITATION` (= action), `SOURCE`, `DESCRIPTION`, `BASIC_SET`, `STORAGE` (the only +changeable field); 463 classifiers, 444 stored. Off by default: the `COMPUTE` (PROCESS) source for +item/sub-item values, status, quality, limits, deadband, and `DATASET.NULL-ATTR.*.COMPUTE`. Not in +the manual: subject `CI-SERVER` (logins; the manual's `F/T-SYSTEM` is the old name), subject/action +`EAL OPERATION`, source `VIA-OPC-UAS` (ISS-051). + +**What is actually recorded (verified):** configuration changes and DSS value writes are stored +as *dataset* events — `SUBJECT_GROUP` = dataset name (`ITEM_DF`, `ITEM_VAL`, `SECTION_DF` …), +`SUBJECT_ATTRIBUTE` = field, old and new value, user and source: `ENT-ENG-MOD` for `dssqld` +(not `QUICKLOAD`), `LOC-ENG-MOD` for the Engineering Module; every `dssqld` run also adds a +`CI-SERVER` `LOGIN`/`LOGOUT` pair. `itmval -p` writes are not audited. The item option +`AUDIT_INFO` (*Audit trailing wanted*, default 0; also on `SUB_ITEM_DF`, `EXTERNAL_ALARM_DF`) made +no difference for these tools; it is meant for the `ITEM.*` classifiers from operator/PROCESS +writes (not tested, ISS-049). A changed `STORAGE` flag is cached by the notifying process +(`ECL_REFRESH`, ISS-050). + +## 4. Setup files (§4.2) + +Only `tls\sup\adtsys.sup` is installed; it documents every keyword and is the template for +per-process files named after the process (`adtsto.sup`, `adtcol01.sup`, `adtdst.sup`, +`adtlog.sup`, `adtovv.sup` for the chronological overview). Without a file, defaults apply. + +| Tab / keyword | Meaning | Default | +|---|---|---| +| General `MAX_OPEN_UNITS` | Storage units open at once (2–100) | 20 | +| `PRT_DEV` | Printer for `ADTLOG` | stdout | +| `QUESIZE` | BUS queue size, kB | see below | +| `SEL_GROUP` | Selection group applied by the process | none | +| Node Numbers `COL_PROC`, `DST_PROC`, `HIS_PROC`, `STO_PROC` | `, ` of collector, distributor, history manager, storage | local `ADTCOL01`, local `ADTSTO`, local `HIS`, `ADTSTO` on the host node | +| `NODE_ECL_FILE`, `NODE_SGP_FILE` | Node holding the classifier / selection group file | storage node | +| Layout `E_LAYOUT` | Message units and widths for the overview / log (`ACTM` time, `SBGP` subject, `SATR`, `SACT`, `SACS`, `SBID` subject id, `USER`, `TERM`, `OVAL`/`NVAL` old/new value, `REAS`, `AAI1`/`MAI1` application info, `ACND`/`ACNM`/`NOND`/`NONM`/`NOTM` node, program and notification time, `SPCE n`, `NWLN n`) | `SPCE,2,ACTM,21,SBGP,13,SATR,13,SACT,11,SACS,15,NWLN,1,SPCE,4,SBID,40,USER,16,NWLN,1,SPCE,6,OVAL,35,NVAL,35,NWLN,1` | +| `E_NOSPACE` | No automatic space between units | off | +| `TIMEFMT` | Picture for `ACTM` (`YYYY MMM DD hh mm ss ppp`) | see below | +| Events `ECL_REFRESH` | Classifier cache refresh, s | 1800 | +| `FLOWC` | Flow-control interval, timeout (s) | 30, 10 | +| `HBEAT` | Heartbeat, s | 10 | +| `TRYCON` | Reconnect interval, s | 10 | +| Header `FORM_FEED`, `HEADER` (repeatable), `HEADER_AFTER` | Log header | off / layout header / never repeated | + +**Installed differences:** the `adtsys.sup` help says `QUESIZE` default 10 kB (minimum 10), the +manual says default and maximum 200 kB; the file sets `QUESIZE = 200`. The `TIMEFMT` default is +`DD/MM/YY hh:mm:ss` in the file help and `DD/MM/YY hh:mm:ss.ppp` in the manual; `ADTLOG` prints +milliseconds, so the manual is right (ISS-051). Also installed: `adtini.sup` (licence value only), +and `fmfprt.sup` assigns the printer function `AUDIT_TRAIL` to `ADTLOG`. + +**Verified:** `adtlog -n ` run from a console prints new events with the default layout; +with a setup file `.sup` holding `SEL_GROUP`, `E_LAYOUT`, `TIMEFMT`, `HEADER`, +`HEADER_AFTER` it printed only the selected events in the custom layout (sample +`examples/CI-Eng-Sample/audit/adtlogci.sup`). + +## 4a. Selection groups (not described in the manual) + +`AUDIT_SELGRP_DF`: `NAME`, `DESCRIPTION`, `EXPRESSION` (memo), `COMPILE`, `LISTING`, +`VALID_EXPRESSION`. The compiler listing names the language: string comparisons on `aai1 acnd +acnm actm mai1 nond nonm reas sacs sact satr sbgp sbid term user`, constant comparisons on `nval +oval`, operators `= != > < >= <=`, `and`, `or`, parentheses; no `LIKE` (prefix match with a range +`>= "X." and < "X/"`). Errors: `ADTT-E-UNKNOWN_TOK`, `ADTT-E-CMP_NO_SUCC`. Verified. + +## 4b. Reading the trail + +`AUDIT_TRAIL` (key `NAME` = `/`; all fields read-only except `PROFILE` and +`APPLICATION_SUB`) is in `dssqld.sup` `NO-EXPORT`: export with `-d AUDIT_TRAIL` or a qli that +names it — the qli export returns 0 records unless `NAME` is in `@FIELDS`; `@SELECT` accepts +`LIKE "X.*"`. RQL `select … from audit_trail` works in reports (sample `CIENG_AUDIT`). `ADT` +group on the test system: lifetime 52 weeks, rollover 1 day. Task files: skill `audit-trail`. + +## 5. Extending classifiers (§4.3) + +New subjects/attributes/actions/sources are added in C: `#define` codes ≥ `0x80000000` in +`adt_ece.h`, names starting with `_`, rebuild `adt_ece()` (`tls\src\adt_ece.c`) and re-link AUDIT, +INTEGRATION, DATABASE Service and every program that uses it. **Installed:** `adt_ece.c`, +`tls\inc\adt_ece.h`, `audit_compile.cmd`/`.mak`, `audit_build.cmd`/`.mak` are shipped. System +integrator work; not practiced. diff --git a/knowledge/progress.md b/knowledge/progress.md index 11777ee..9f935bd 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -62,7 +62,7 @@ AID is not needed. | 11 | IM 36K10R40 | Report Server Setup | done for processes, set-up files, interactive generator, `rptstp`; extra generators, separate RPI servers, custom destinations from docs ([notes](manuals/IM36K10R40-01EN.md)) | | 11 | IM 36K10C30 | Engineering Module - Reporting | done by quick load for report definitions (ad hoc + parameters, schedule, item trigger, HTML, logbook), generated reports and a file device/destination; Engineering Module forms, generate and view checked by the user; report component in displays and hardcopy printers from docs ([notes](manuals/IM36K10C30-01EN.md)) | | 11 | IM 36K10E10 | Excel Add-in | summarized, from docs (Excel not installed on the test system) ([notes](manuals/IM36K10E10-01EN.md)) | -| 12 | IM 36K10L25 | Audit Trail Management | not started | +| 12 | IM 36K10L25 | Audit Trail Management | done for processes, classifiers, `AUDIT_TRAIL` reading/export, audit report, selection groups, `ADTLOG` (default and filtered); distributor, extra collectors, classifier extension in C and operator-side `ITEM.*` events from docs ([notes](manuals/IM36K10L25-01EN.md)); skill `audit-trail` | | 13 | IM 36K10J20 | High Availability Computing | not started (needs two servers) | | 13 | IM 36K10J40 | Active Directory Integration | not started (needs a domain) | | — | IM 36K01A10 / A20 / A30 | Read Me First, License, OSS terms | skipped (no engineering content) | @@ -109,7 +109,7 @@ now come before classes and objects (phase 6), and the other interfaces follow a | C10 | Integrator time unit: integration granule `itm_int_secs` in `itm.sup` ([task](../.claude/skills/item-engineering/tasks/sub-items.md)) | passed | passed | 60 → `RUN_SECONDS` +1 per minute; restored to 1 (file identical to backup), +1 per second again ([ISS-010](issues.md)). Elevated restarts run by the user. | | G10 | Displays, symbols, Operator Interface test | display done (phase 10); symbols not practiced | display added | Display `CIENG_Tank` built in the Edit Module and checked in the HTML display. | | L41/C10 | Modbus TCP line, station, scan type, points, connected items by quick load ([task](../.claude/skills/equipment/tasks/modbus-station.md)) | passed | passed | Loopback to CI Server's own Modbus slave (`eqpmdcmem` + `eqpmdcslvtcp` on 5020, started by hand). Line load created and started `EQPCIENG`; removal stopped it and deleted its files. Write/read-back, off-scan/on-scan checked; full remove/reload from sample files. Protocol must be Open Modbus/TCP ([ISS-024](issues.md)). Mirror start files copied to `tls\com` by the user; after a restart everything came back under the CI Service and the setpoint was re-sent on connect. | -| G10 | Alarms, reports, audit, RDBMS, history | alarms (phase 8), history (phase 9), reports (phase 11) done; audit, RDBMS not practiced | alarms, history, reports added | Covered in their own phases (7–12). | +| G10 | Alarms, reports, audit, RDBMS, history | alarms (phase 8), history (phase 9), reports (phase 11), audit (phase 12) done; RDBMS not practiced | alarms, history, reports, audit added | Covered in their own phases (7–12). | | R10/R20 | Read a setup file: active settings and keyword help ([task](../.claude/skills/portal-setup/tasks/read-setup-file.md)) | passed | n/a | Read-only. Compared with the Setup File Editor GUI for `wfla_display.sup`, `wflgdi.sup` and all 9 tabs of `jwuiisg.sup`: fields and values identical. Manual differences logged as ISS-012 to ISS-017 (installed software taken as the reference). | | R10 | Check web access for CI View: ports, Remote Connect page, `DEPLOY` folder ([task](../.claude/skills/portal-setup/tasks/check-web-access.md)) | passed | n/a | 8080/8443 listening, page 200, six `DEPLOY` folders. | | R10/R20 | Change a setup file safely ([task](../.claude/skills/portal-setup/tasks/change-setup-file.md)) | passed | n/a | `jwuiisg.sup` HTTP port 8080 → 8081 (text edit, elevated restart): 8081 served the page, 8080 refused; restored, hash identical to backup. Editor: *OK* writes at once, *Reset Field* restores the default (ISS-016). | @@ -142,3 +142,6 @@ now come before classes and objects (phase 6), and the other interfaces follow a | L50/P30 | DSS tools: processes, `dss.sup`, quick load macro/include/memo file, `dssutl` read, DSS compiler syntax check ([task](../.claude/skills/system-management/tasks/dss-tools.md)) | passed | n/a | Memo from file: absolute path ≤ 82 characters only (ISS-046). Dictionary untouched. | | C30 | Report component on a display, hardcopy printer, extra report generators | not practiced | n/a | GUI / no printer / admin restart. | | E10 | Excel Add-in (DART) | not practiced | n/a | Excel not installed on the test system. | +| L25 | AUDIT Service checks: processes, `ADT` group, classifiers, selection groups ([task](../.claude/skills/audit-trail/tasks/audit-checks.md)) | passed | n/a | `adtsto` + `adtcol`; 463 classifiers, 444 stored; `ADT` lifetime 52 weeks; manual differences ISS-051. | +| L25 | Read the audit trail: export, RQL, audit report, what each tool records ([task](../.claude/skills/audit-trail/tasks/read-audit-trail.md)) | passed | passed | Report `CIENG_AUDIT` (`19_audit_df.qli`); qli export needs `NAME` in `@FIELDS`; `dssqld` = `ENT-ENG-MOD`, Engineering Module = `LOC-ENG-MOD` (checked by the user); `itmval` not audited (ISS-049). | +| L25 | Classifier `STORAGE`, selection groups, event logger `ADTLOG` ([task](../.claude/skills/audit-trail/tasks/configure-audit.md)) | passed | passed | Selection group `CIENG_ITEMS` compiles on load; `adtlog -n adtlogci` with sample setup file printed only CI-Eng-Sample events; storage flag cached (ISS-050); `AUDIT_INFO` effect not shown (ISS-049). Full sample remove/reload 0 errors. | -- 2.45.3 From f016f516b833802428ddee3c6d73503c851e1e3f Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 17:18:07 +1000 Subject: [PATCH 4/5] Correct ISS-045: dssqld ad-hoc runs never print; note Engineering Module audit views Co-Authored-By: Claude Opus 5.5 --- .claude/skills/audit-trail/tasks/configure-audit.md | 2 +- .claude/skills/audit-trail/tasks/read-audit-trail.md | 4 +++- .claude/skills/reporting/tasks/define-reports.md | 5 +++-- knowledge/issues.md | 2 +- knowledge/manuals/IM36K10C30-01EN.md | 6 +++--- 5 files changed, 11 insertions(+), 8 deletions(-) diff --git a/.claude/skills/audit-trail/tasks/configure-audit.md b/.claude/skills/audit-trail/tasks/configure-audit.md index c9da17f..db59187 100644 --- a/.claude/skills/audit-trail/tasks/configure-audit.md +++ b/.claude/skills/audit-trail/tasks/configure-audit.md @@ -24,7 +24,7 @@ NAME,STORAGE "...",0 ``` -`dssqld -m` (the change itself is audited: `AUDIT_EVENT_CLAS_DF` `STORAGE` `MODIFY`). +`dssqld -m`, or in the Engineering Module *Configuration › Audit trail › Event classifiers* (the change itself is audited: `AUDIT_EVENT_CLAS_DF` `STORAGE` `MODIFY`). **Not immediate:** the processes that report events (e.g. `DSSSDA`) cache the storage flags and re-read them every `ECL_REFRESH` seconds (default 1800). In the test a switched-off classifier was still recorded right after the change (ISS-050). Confirm with the user before diff --git a/.claude/skills/audit-trail/tasks/read-audit-trail.md b/.claude/skills/audit-trail/tasks/read-audit-trail.md index 7c9f990..ebcbd85 100644 --- a/.claude/skills/audit-trail/tasks/read-audit-trail.md +++ b/.claude/skills/audit-trail/tasks/read-audit-trail.md @@ -82,4 +82,6 @@ report `CIENG_AUDIT` (`examples/CI-Eng-Sample/19_audit_df.qli`) lists the last h `CI-Eng-Sample.*`; generate it like any ad-hoc report (`define-reports.md` §2). Generated from `dssqld` it is stored but not printed (`FSL-E-PRT_UNKUSER`, ISS-045). -The Engineering Module also has the system report `AUDIT_TRAIL` (IM 36K10C30 App. 1). +In the Engineering Module, *Configuration › Reporting › Reports* holds the system reports +`AUDIT_TRAIL` and `UA_SERVER_AUDIT` (IM 36K10C30 App. 1). Generated there (as the logged-in +user) `CIENG_AUDIT` printed to `CIENG_FILE` and showed in the report viewer (checked by the user). diff --git a/.claude/skills/reporting/tasks/define-reports.md b/.claude/skills/reporting/tasks/define-reports.md index 8714967..40f39bb 100644 --- a/.claude/skills/reporting/tasks/define-reports.md +++ b/.claude/skills/reporting/tasks/define-reports.md @@ -66,8 +66,9 @@ NAME,PARAM_VALUE_1,GENERATE ``` `dssqld -m`. `GENERATE` returns to 0 when finished (a second or two for small reports). The run is -made as user `FULL AUTHORIZATION` by `DSSQLD`; without `ADHOC_DEST` the manager then logs -`FSL-E-PRT_UNKUSER` (the report is still stored, ISS-045). +made as user `FULL AUTHORIZATION` by `DSSQLD`; the manager then logs `FSL-E-PRT_UNKUSER` and +prints nothing, even with `ADHOC_DEST` set (the report is still stored, ISS-045). To get printed +output, generate from the Engineering Module. ## 3. Read generated reports diff --git a/knowledge/issues.md b/knowledge/issues.md index 92dd5da..987e5a8 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -64,7 +64,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-042 | 2026-10-01 | GRAPHICS (layouts) | Installed vs `Layouts.readme`: the factory layouts use status line item types `displayName`, `playbackIndicator` and `dateTime` and the commands `reload ` / `reload all`, none of which the readme lists (readme: `statusText`, `userName`, `progresBar`, `graphicsQueueLevel`, `connectionState`); the readme also writes `zooom` for the zoom command (factory files use `zoom`). | open | Installed software is the reference (standing user decision). Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §2 | | ISS-043 | 2026-10-01 | REPORT (system reports) | IM 36K10C30 App. 1.3 names two system reports `ALM_ATTS_CUR` and `ALM_ATRS_HIS`; the installed reports are `ALM_ATTRS_CUR` and `ALM_ATTRS_HIS`. The other 26 names match. | open | Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10C30-01EN.md` §8 (done) | | ISS-044 | 2026-10-01 | REPORT (scheduling) | Behaviour not in the manuals, found by quick load: a generation interval below 10 minutes is refused (`HIS-E-ROLLTOFAST`, the interval is the rollover of the report's storage group); a scheduled report cannot be deleted (`RPT-E-ACTIVE`) until `ACTIVATION_TIME` and `GENERATION_INTERVAL` are cleared; `CORRECT_DAYLIGHT` 0 counts intervals in UTC (06:00 set for January ran at 05:00 in October); a past activation time moves to the next slot - once (modify, past time within the lifetime) a single report labelled with the old time was generated, at insert with an older time none. | open | Documented as verified behaviour; the one-off generation for a past activation time is not fully understood. Close when the user confirms. | `.claude/skills/reporting/tasks/define-reports.md` §1, §5, §6; `knowledge/manuals/IM36K10C30-01EN.md` §2; `examples/CI-Eng-Sample/83a_stop_report_df.qli`, `18_report_df.qli` | -| ISS-045 | 2026-10-01 | REPORT (ad hoc from `dssqld`) | Generating ad hoc with `REPORT_DF.GENERATE` = 1 from `dssqld` (user `FULL AUTHORIZATION`) on a report without `ADHOC_DEST` logs `FSL-E-PRT_UNKUSER, Job submitted by unknown user (FULL AUTHORIZATION)` and `RPT-I-TRYPRINT` in `umhlog.log`; the generated report is stored normally. With `ADHOC_DEST` set no error appears and the device gets the output. Related to the R1.03 known issue on report generation and default printers (IM 36K01A50, REPORT 1.11). | open | Workaround documented (set `ADHOC_DEST`). 2026-10-01: generating from the Engineering Module as user `ADMIN` with destination `CIENG_FILE` printed without errors, so it only affects runs from `dssqld`. Close when the user confirms. | `.claude/skills/reporting/tasks/define-reports.md` §2; `knowledge/manuals/IM36K10C30-01EN.md` §6 | +| ISS-045 | 2026-10-01 | REPORT (ad hoc from `dssqld`) | Generating ad hoc with `REPORT_DF.GENERATE` = 1 from `dssqld` (user `FULL AUTHORIZATION`) on a report without `ADHOC_DEST` logs `FSL-E-PRT_UNKUSER, Job submitted by unknown user (FULL AUTHORIZATION)` and `RPT-I-TRYPRINT` in `umhlog.log`; the generated report is stored normally. Phase 12 correction (2026-10-01): with `ADHOC_DEST` set the same error appears and nothing is printed (`CIENG_AUDIT`, `CIENG_TANK1` after a sample reload); the same report generated from the Engineering Module as `ADMIN` printed to `CIENG_FILE`. Related to the R1.03 known issue on report generation and default printers (IM 36K01A50, REPORT 1.11). | open | Workaround documented (set `ADHOC_DEST`). 2026-10-01: generating from the Engineering Module as user `ADMIN` with destination `CIENG_FILE` printed without errors, so it only affects runs from `dssqld`. Close when the user confirms. | `.claude/skills/reporting/tasks/define-reports.md` §2; `knowledge/manuals/IM36K10C30-01EN.md` §6 | | ISS-046 | 2026-10-01 | DATABASE (`dssqld` memo) | A memo field loaded from a file (`@""@`, IM 36K10L50 §3.10) fails with a relative name (`CRL-E-ENOENT`, the file is read on the server side) and with a long absolute path (`DSSG-E-STRBUFSMAL`, buffer 83); a short absolute path works. The manual gives no limits. | open | Documented: use inline memos, or an absolute path ≤ 82 characters. Close when the user confirms. | `.claude/skills/system-management/tasks/dss-tools.md` §2; `knowledge/manuals/IM36K10L50-01EN.md` §4 | | ISS-047 | 2026-10-01 | REPORT (RQL manuals) | The manuals disagree: default `@WORKSPACE` 500 KB (IM 36K10R40 §2.2.2) vs 16 KB (IM 36K10C30 table 2.1-1, IM 36K10P20 §9.6); maximum `@WIDTH` 512 (R40, P20 §4) vs 5000 (P20 §9.6); `@FORMFEED` described with opposite meanings (C30: not 1 = form feed; P20: 0 = blank lines, default 1). Installed set-up files set `@workspace` explicitly (500 in `rptge1.rpt`, 100 in `rptgen.rpt`) and `@formfeed 0` for the interactive generator. | open | Not tested (no printer); the set-up files make the defaults irrelevant in practice. | `knowledge/manuals/IM36K10R40-01EN.md` §2; `knowledge/manuals/IM36K10P20-01EN.md` §3 | | ISS-048 | 2026-10-01 | REPORT (ad-hoc parameters) | The prompt `[ITEM:NAME like "CI-Eng-Sample.TANK1.*"]Item for statistics:` (filter form as in IM 36K10C30 §2.1) gives an item tree browser in the Engineering Module generate dialog, but the tree shows all sections, not only `TANK1` items (checked by the user). | open | Try other filter forms (`%` wildcard, `SECTION = …`, `[ITEM:TAG="…"]`) and the display report component. | `.claude/skills/reporting/tasks/define-reports.md`; `knowledge/manuals/IM36K10C30-01EN.md` §2; `examples/CI-Eng-Sample/18_report_df.qli` comment | diff --git a/knowledge/manuals/IM36K10C30-01EN.md b/knowledge/manuals/IM36K10C30-01EN.md index 21f8813..8104c5c 100644 --- a/knowledge/manuals/IM36K10C30-01EN.md +++ b/knowledge/manuals/IM36K10C30-01EN.md @@ -112,9 +112,9 @@ Logbook on a display needs *Logbook Enabled* and *Visible* in the report. Not pr `dssqld -r` (needs `REPORT_DELETE_GENERATED_REPORT`; users only delete their own ad-hoc ones). - `rptgen -s rptgen.rpt` for trying RQL (`IM36K10R40-01EN.md` §6). -**Verified:** ad-hoc runs from `dssqld` are made by user `FULL AUTHORIZATION`; without an ad-hoc -destination `RPTMAN` then logs `FSL-E-PRT_UNKUSER, Job submitted by unknown user` (the report is -still stored; ISS-045). With `ADHOC_DEST` set the output went to the device without errors. +**Verified:** ad-hoc runs from `dssqld` are made by user `FULL AUTHORIZATION`; `RPTMAN` then logs +`FSL-E-PRT_UNKUSER, Job submitted by unknown user` and prints nothing, with or without +`ADHOC_DEST` (the report is still stored; ISS-045, corrected in phase 12). Scheduled and triggered runs are made by `RPTMAN` and print to `DEST_NAME`. Generated from the Engineering Module the run is made by the logged-in user (`ADMIN`, process `JHMISET…`) and printed to the chosen destination without errors; *View* lists generated reports by local time and has a -- 2.45.3 From 5b6a936592c3ca6c4d94fad2e1ed9fa8cda3da08 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 17:32:47 +1000 Subject: [PATCH 5/5] Record the classifier storage cache test (ISS-050) Co-Authored-By: Claude Opus 5.5 --- .claude/skills/audit-trail/tasks/configure-audit.md | 5 +++-- knowledge/issues.md | 2 +- knowledge/manuals/IM36K10L25-01EN.md | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.claude/skills/audit-trail/tasks/configure-audit.md b/.claude/skills/audit-trail/tasks/configure-audit.md index db59187..165dc35 100644 --- a/.claude/skills/audit-trail/tasks/configure-audit.md +++ b/.claude/skills/audit-trail/tasks/configure-audit.md @@ -26,8 +26,9 @@ NAME,STORAGE `dssqld -m`, or in the Engineering Module *Configuration › Audit trail › Event classifiers* (the change itself is audited: `AUDIT_EVENT_CLAS_DF` `STORAGE` `MODIFY`). **Not immediate:** the processes that report events (e.g. `DSSSDA`) cache the storage flags and -re-read them every `ECL_REFRESH` seconds (default 1800). In the test a switched-off classifier was -still recorded right after the change (ISS-050). Confirm with the user before +re-read them every `ECL_REFRESH` seconds (default 1800). Verified: a classifier switched off was +still recorded right after the change and no longer 31 minutes later; switching it back on is +delayed the same way. Allow up to 30 minutes or restart CI Server (ISS-050). Confirm with the user before switching anything off. ### Item option *Audit trailing wanted* (`AUDIT_INFO`) diff --git a/knowledge/issues.md b/knowledge/issues.md index 987e5a8..427367a 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -69,5 +69,5 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-047 | 2026-10-01 | REPORT (RQL manuals) | The manuals disagree: default `@WORKSPACE` 500 KB (IM 36K10R40 §2.2.2) vs 16 KB (IM 36K10C30 table 2.1-1, IM 36K10P20 §9.6); maximum `@WIDTH` 512 (R40, P20 §4) vs 5000 (P20 §9.6); `@FORMFEED` described with opposite meanings (C30: not 1 = form feed; P20: 0 = blank lines, default 1). Installed set-up files set `@workspace` explicitly (500 in `rptge1.rpt`, 100 in `rptgen.rpt`) and `@formfeed 0` for the interactive generator. | open | Not tested (no printer); the set-up files make the defaults irrelevant in practice. | `knowledge/manuals/IM36K10R40-01EN.md` §2; `knowledge/manuals/IM36K10P20-01EN.md` §3 | | ISS-048 | 2026-10-01 | REPORT (ad-hoc parameters) | The prompt `[ITEM:NAME like "CI-Eng-Sample.TANK1.*"]Item for statistics:` (filter form as in IM 36K10C30 §2.1) gives an item tree browser in the Engineering Module generate dialog, but the tree shows all sections, not only `TANK1` items (checked by the user). | open | Try other filter forms (`%` wildcard, `SECTION = …`, `[ITEM:TAG="…"]`) and the display report component. | `.claude/skills/reporting/tasks/define-reports.md`; `knowledge/manuals/IM36K10C30-01EN.md` §2; `examples/CI-Eng-Sample/18_report_df.qli` comment | | ISS-049 | 2026-10-01 | AUDIT (item option *Audit trailing wanted*) | IM 36K10G10 ch. 9 and the classifier list (IM 36K10L25 App. 1, `ITEM.VALUE.MODIFY.`, `ITEM.HIGH-LIMIT…`) suggest item changes are audited per item when `AUDIT_INFO` = 1. On R1.03.00 none of the tested tools produced an `ITEM.*` event: `itmval -p` writes are not audited at all (with `AUDIT_INFO` 0 or 1); value writes through DSS (`dssqld -m ITEM_VAL`) and Engineering Module *Update value* are audited as dataset events (`ITEM_VAL`, `ITEM_VALUE` / `ITEM_VALUE_STR` / `STATUS`) for every item regardless of `AUDIT_INFO`. Operator-display writes and PROCESS writes (`opc.sup` `AUDIT = YES`, `COMPUTE` classifiers off by default) were not tested (no input field in the sample displays). | open | Test an operator value input on an item with `AUDIT_INFO` 1 (needs a display with an input field) and, if wanted, PROCESS with `AUDIT = YES`. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `.claude/skills/audit-trail/tasks/read-audit-trail.md` §2; `knowledge/manuals/IM36K10L25-01EN.md` §3 | -| ISS-050 | 2026-10-01 | AUDIT (classifier `STORAGE`) | Setting `AUDIT_EVENT_CLAS_DF.STORAGE` = 0 for `DATASET.NULL-ATTR.MODIFY.ENT-ENG-MOD` at 17:01:12 did not stop the next `dssqld -m ITEM_VAL` change from being stored (17:01:12.573). IM 36K10L25 §3.2 explains a per-process cache refreshed every `ECL_REFRESH` s (default 1800); the notifier here is `DSSSDA`, so the change should apply within 30 minutes. | investigating | Re-test after 17:31 on 2026-10-01, then set `STORAGE` back to 1. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `knowledge/manuals/IM36K10L25-01EN.md` §3 | +| ISS-050 | 2026-10-01 | AUDIT (classifier `STORAGE`) | Setting `AUDIT_EVENT_CLAS_DF.STORAGE` = 0 for `DATASET.NULL-ATTR.MODIFY.ENT-ENG-MOD` at 17:01:12 did not stop the next `dssqld -m ITEM_VAL` change from being stored (17:01:12.573). IM 36K10L25 §3.2 explains a per-process cache refreshed every `ECL_REFRESH` s (default 1800); the notifier here is `DSSSDA`, so the change should apply within 30 minutes. | open | Re-tested: at 17:32:18 (after the 30-minute refresh) the same change was **not** stored, so the flag works with a delay. Set back to 1 at 17:32; the next change was still not stored (the cache works in both directions). Documented: allow up to `ECL_REFRESH` (1800 s) or restart CI Server. Close when the user confirms. | `.claude/skills/audit-trail/tasks/configure-audit.md` §1; `knowledge/manuals/IM36K10L25-01EN.md` §3 | | ISS-051 | 2026-10-01 | AUDIT (manual vs installed) | Differences between IM 36K10L25 and R1.03.00: (1) App. 1 lists subject `F/T-SYSTEM`, the installed classifiers use `CI-SERVER` (logins) and also `EAL OPERATION` (subject and action) and source `VIA-OPC-UAS`, not in the manual; 463 classifiers installed. (2) App. 1 explanations of `SHELVE` and `UN-SHELVE` are swapped. (3) `QUESIZE`: manual default and maximum 200 kB, `adtsys.sup` help default 10 kB, minimum 10 (file sets 200). (4) `TIMEFMT` default: manual `DD/MM/YY hh:mm:ss.ppp`, `adtsys.sup` help without `.ppp`; `ADTLOG` output shows milliseconds (manual right). (5) `dssqld` changes are recorded with source `ENT-ENG-MOD`, not `QUICKLOAD`. (6) The selection expression language is not described in the manual; the compiler listing gives the words and operators (no `LIKE`). (7) `ADT` group lifetime 52 weeks on the test system vs 2 days default when `ADTSTO` creates it (§2.1.1). | open | Documented in the L25 summary and the `audit-trail` skill. Close when the user confirms. | `knowledge/manuals/IM36K10L25-01EN.md`; `.claude/skills/audit-trail/tasks/*.md` | diff --git a/knowledge/manuals/IM36K10L25-01EN.md b/knowledge/manuals/IM36K10L25-01EN.md index 2c2851f..3292ff4 100644 --- a/knowledge/manuals/IM36K10L25-01EN.md +++ b/knowledge/manuals/IM36K10L25-01EN.md @@ -82,8 +82,8 @@ as *dataset* events — `SUBJECT_GROUP` = dataset name (`ITEM_DF`, `ITEM_VAL`, ` `CI-SERVER` `LOGIN`/`LOGOUT` pair. `itmval -p` writes are not audited. The item option `AUDIT_INFO` (*Audit trailing wanted*, default 0; also on `SUB_ITEM_DF`, `EXTERNAL_ALARM_DF`) made no difference for these tools; it is meant for the `ITEM.*` classifiers from operator/PROCESS -writes (not tested, ISS-049). A changed `STORAGE` flag is cached by the notifying process -(`ECL_REFRESH`, ISS-050). +writes (not tested, ISS-049). A changed `STORAGE` flag takes effect only after the notifying process +re-reads it (`ECL_REFRESH`, up to 30 minutes, both directions; verified, ISS-050). ## 4. Setup files (§4.2) -- 2.45.3