---
task: Check AUDIT Service (processes, storage group ADT, classifiers, selection groups)
version: R1.05 (first written for R1.03)
source: IM 36K10L25-01EN §1.2, §2.1.1, §2.3.1, §4.1 (4th ed., Feb. 2026; text unchanged from the 3rd ed.); practiced on the test system 2026-10-01
status: verified on R1.03 (2026-10-01); verified on the R1.05 test server 2026-10-09 (read-only: processes, ADT group, classifier and selection group exports, start scripts, setup files)
---

# AUDIT Service checks

All read-only.

## 1. Processes

```
tasklist /FI "IMAGENAME eq adt*"
durwfp -p adtsto -t 0      (errorlevel 0 = running)
```

Default (`tls\com\audit_start.cmd`): `adtsto.exe` (storage, process `ADTSTO`) and `adtcol.exe`
(collector `ADTCOL01`). AUDIT Service starts after HISTORY Service and refuses to start when
`his` is not running; `ADTCOL01` exits if storage group `ADT` does not exist (first start:
`ADTSTO` creates it). `adtdst` (distributor), `adtlog` (event logger) and `adtcol02` are only in
commented lines. Stop: `audit_stop.cmd` (`durstp` on `adt*`, admin).

R1.05 (verified 2026-10-09): same two processes running, `adtlog` and `adtdst` not running
(`durwfp` 1). New in R1.05: `audit_start.cmd` ends by calling every
`%TLS_ROOT_PATH%\tls\com\?*_audit_start.cmd`, and `audit_stop.cmd` calls every
`?*_audit_stop.cmd` **before** it stops the `adt*` processes (ISS-142; same hook pattern as the
other start scripts, ISS-121). Use such a file for your own additions (e.g. a permanent
`ADTLOG`) instead of editing the product script. Not described in IM 36K10L25.

## 2. Storage group `ADT`

```
@FIELDS
NAME,LIFE_TIME,ROLLOVER_INT,START_TIME,STOP_TIME,TYPE
@SELECT
'NAME = "ADT"'
@HIS_GROUP_DF
```

`dssqld -e adt.qlo adt.qli`. History type 6 (audit). Manual default when `ADTSTO` creates it:
rollover 1 day, unit lifetime 2 days; the R1.03 test system and the R1.05 test server both had
**52 weeks** lifetime, rollover 1 day (type shown as `Audit` in the export). While storage of `ADT` is stopped, new events are refused (logged via UMH). Unit
details: skill `history-management`, `history-checks.md`.

## 3. Classifiers and selection groups

```
dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF
dssqld -e sgp.qlo -d AUDIT_SELGRP_DF
```

R1.03.00 test system: 463 classifiers (`BASIC_SET` 1), 444 with `STORAGE` 1. Off by default:
everything from source `COMPUTE` (PROCESS Service) on `ITEM`/`SUB-ITEM` values, status,
quality, limits and deadband, and `DATASET.NULL-ATTR.*.COMPUTE`. No selection groups exist
until you create one (the file `tls\dat\adt_sgp.dat` is created empty by `ADTSTO`).

R1.05 test server (2026-10-09): **499** classifiers, all `BASIC_SET` 1, **478** with `STORAGE` 1.
The 36 extra ones are exactly the new action and sources (ISS-141): `PENDING` on
`ITEM.VALUE` / `ITEM.STATUS` (sources `HMI`, `LOC-ENG-MOD`, `OPER-INTERFACE`, `OTHERS`,
`VIA-OPC-UAS`, `COMPUTE`), and `REST-SERVER`, `PYTOOLS`, `PASSWORD-CHECK` on `CI-SERVER` login /
logout / login attempt and `DATASET` insert / modify / delete, plus `ITEM.VALUE`, `STATUS`,
`QUALITY-CODE` `MODIFY` for `REST-SERVER` and `PYTOOLS`. Off: the same 19 `COMPUTE`
classifiers as on R1.03 plus `ITEM.VALUE.PENDING.COMPUTE` and `ITEM.STATUS.PENDING.COMPUTE`.
(463 + 36 = 499 and 19 + 2 = 21 off; the R1.03 list itself is not kept in the repo.)
No selection groups on the R1.05 test server.

Files: `%TLS_DAT_PATH%\adt_ecl.*` (classifiers), `adt_sgp.*` (selection groups); audit records
are in the history files of group `ADT` (`%TLS_HIS_PATH%`).

## 4. Setup files

Only `tls\sup\adtsys.sup` is installed (`QUESIZE = 200`, the rest commented): it is the keyword
reference and template. A process reads a setup file named after itself (`adtsto.sup`,
`adtcol01.sup`, `adtlog.sup` …) if present. Keywords: `configure-audit.md` §4 and the L25 summary.

R1.05 (2026-10-09): `adtsys.sup` / `adtsys.tpl` differ from R1.03 only by two new `E_LAYOUT`
units `APPRR` (approval reason) and `APPR` (approver) (ISS-140). `adtini.sup` differs only in
the licence lines; `fmfprt.sup` and the `AUDIT_EVENT_CLAS_DF` / `AUDIT_SELGRP_DF` dataset
definitions are identical; `dssqld.sup` still has `NO-EXPORT=AUDIT_TRAIL`.