---
name: audit-trail
description: >-
  CI Server R1.05 AUDIT Service and audit trail. Use when the user wants to know who changed
  what and when (item value written, limit or description changed, item / section / object /
  report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read
  or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user,
  approval reason and approver of a change (APPROVAL_REASON, APPROVER, FDA Part 11), source
  HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / REST-SERVER / PYTOOLS / PASSWORD-CHECK /
  ODBC / QUICKLOAD, PENDING item writes), make an audit
  report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF,
  STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection
  groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events
  (ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol,
  adtdst, audit_start, ?*_audit_start.cmd extension scripts), or change how long the audit
  trail is kept (ADT lifetime). Source IM 36K10L25-01EN.
---

# Audit trail (R1.05)

Re-checked on R1.05 on 2026-10-09 (read-only). IM 36K10L25 4th edition changed only its contact
information, but the installed software has grown (none of it is in the manual):
- `AUDIT_TRAIL` has two new fields, `APPROVAL_REASON` (256) and `APPROVER` (128), filled by
  display writes that carry a reason and approver (IM 36K10C50 §2.22, §4.12; ISS-099, ISS-140).
- 499 classifiers instead of 463: new action `PENDING` and new sources `REST-SERVER`, `PYTOOLS`,
  `PASSWORD-CHECK` (ISS-141).
- `audit_start.cmd` / `audit_stop.cmd` call extension scripts `?*_audit_start.cmd` /
  `?*_audit_stop.cmd` (ISS-142).
Processes, `ADT` group, selection-group dataset and `adtsys.sup` keywords are otherwise as on R1.03.
Paths: read `TLS_*` (`set TLS`); on the R1.05 test server program and data are both under
`C:\Yokogawa\CIServer\tls`. Skill text still shows R1.03 paths where it names a full path.

Background: `knowledge/manuals/IM36K10L25-01EN.md` (processes, classifiers, setup keywords,
installed findings), `IM36K10G10-01EN.md` ch. 9 (overview), `IM36K10C40-01EN.md` (storage groups),
`IM36K10P20-01EN.md` (RQL for audit reports).

Rules:
- Run `system-check` first; follow the user's chosen way of working.
- The audit trail is evidence: single records cannot be deleted, and nothing in these tasks
  deletes them. Changing the `ADT` storage group (lifetime, stop, delete units) loses history —
  only with the user's explicit approval (skill `history-management`).
- Switching a classifier's `STORAGE` off stops recording that event type: confirm with the user.
- Setup files in `tls\sup` (`adtsys.sup`, per-process files) need admin rights: hand them to
  the user (skill `portal-setup`, `change-setup-file.md`).
- Example names come from `CI-Eng-Sample` (selection group `CIENG_ITEMS`, report `CIENG_AUDIT`,
  logger setup file `audit/adtlogci.sup`).

| Task | File | Status |
|---|---|---|
| Check AUDIT Service: processes, storage group `ADT`, classifier and selection group counts | `tasks/audit-checks.md` | verified (R1.03); verified on R1.05 2026-10-09 (read-only) |
| Read the audit trail: export, RQL query, audit report, what gets recorded by which tool | `tasks/read-audit-trail.md` | verified (R1.03); on R1.05 RQL read, field list and sources checked 2026-10-09; the sample report load passed 2026-10-08 (load check only) |
| Approval reason / approver in the audit trail (`APPROVAL_REASON`, `APPROVER`) | `tasks/read-audit-trail.md` §1a | verified on R1.05 that the fields exist and are filled for operator writes; custom alarm acknowledgement not tested (display changes not allowed on the shared server) |
| Choose what is stored (classifier `STORAGE`), selection groups, event logger `ADTLOG` | `tasks/configure-audit.md` | verified (R1.03, incl. operator-side item value events, ISS-049); on R1.05 files and datasets checked, selection group load passed 2026-10-08; `ADTLOG` not re-run (starting processes not allowed on the shared server) |
| Distributor process, extra collectors, new classifier entities in C | L25 summary §2, §5 | from docs |