---
task: Check AUDIT Service (processes, storage group ADT, classifiers, selection groups)
version: R1.03
source: IM 36K10L25-01EN §1.2, §2.1.1, §2.3.1, §4.1; practiced on the test system 2026-10-01
status: verified
---

# AUDIT Service checks

All read-only.

## 1. Processes

```
tasklist /FI "IMAGENAME eq adt*"
durwfp -p adtsto -t 0      (errorlevel 0 = running)
```

Default (`tls\com\audit_start.cmd`): `adtsto.exe` (storage, process `ADTSTO`) and `adtcol.exe`
(collector `ADTCOL01`). AUDIT Service starts after HISTORY Service and refuses to start when
`his` is not running; `ADTCOL01` exits if storage group `ADT` does not exist (first start:
`ADTSTO` creates it). `adtdst` (distributor), `adtlog` (event logger) and `adtcol02` are only in
commented lines. Stop: `audit_stop.cmd` (`durstp` on `adt*`, admin).

## 2. Storage group `ADT`

```
@FIELDS
NAME,LIFE_TIME,ROLLOVER_INT,START_TIME,STOP_TIME,TYPE
@SELECT
'NAME = "ADT"'
@HIS_GROUP_DF
```

`dssqld -e adt.qlo adt.qli`. History type 6 (audit). Manual default when `ADTSTO` creates it:
rollover 1 day, unit lifetime 2 days; the test system had **52 weeks** lifetime, rollover
1 day. While storage of `ADT` is stopped, new events are refused (logged via UMH). Unit
details: skill `history-management`, `history-checks.md`.

## 3. Classifiers and selection groups

```
dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF
dssqld -e sgp.qlo -d AUDIT_SELGRP_DF
```

R1.03.00 test system: 463 classifiers (`BASIC_SET` 1), 444 with `STORAGE` 1. Off by default:
everything from source `COMPUTE` (PROCESS Service) on `ITEM`/`SUB-ITEM` values, status,
quality, limits and deadband, and `DATASET.NULL-ATTR.*.COMPUTE`. No selection groups exist
until you create one (the file `tls\dat\adt_sgp.dat` is created empty by `ADTSTO`).

Files: `%TLS_DAT_PATH%\adt_ecl.*` (classifiers), `adt_sgp.*` (selection groups); audit records
are in the history files of group `ADT` (`%TLS_HIS_PATH%`).

## 4. Setup files

Only `tls\sup\adtsys.sup` is installed (`QUESIZE = 200`, the rest commented): it is the keyword
reference and template. A process reads a setup file named after itself (`adtsto.sup`,
`adtcol01.sup`, `adtlog.sup` …) if present. Keywords: `configure-audit.md` §4 and the L25 summary.