cliu
bf7d88a027
Full manual diffs (L15, C20, E30, L25, J40, C10 §2, L10, P10, P11, J20, C30, P20, R40, E10) and read-only checks on the shared R1.05 test server. Skills and summaries moved to R1.05; new skill pytools (IM 36K10P40) from docs (no Python on the test server). Issues ISS-132..181; corrections to version-differences (E10, E30, P11, dss_ath_grp_u0104); C10 summary lists the 3 new authorization actions; r105-verification V10-V17. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
4.2 KiB
Markdown
54 lines
4.2 KiB
Markdown
---
|
|
name: audit-trail
|
|
description: >-
|
|
CI Server R1.05 AUDIT Service and audit trail. Use when the user wants to know who changed
|
|
what and when (item value written, limit or description changed, item / section / object /
|
|
report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read
|
|
or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user,
|
|
approval reason and approver of a change (APPROVAL_REASON, APPROVER, FDA Part 11), source
|
|
HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / REST-SERVER / PYTOOLS / PASSWORD-CHECK /
|
|
ODBC / QUICKLOAD, PENDING item writes), make an audit
|
|
report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF,
|
|
STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection
|
|
groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events
|
|
(ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol,
|
|
adtdst, audit_start, ?*_audit_start.cmd extension scripts), or change how long the audit
|
|
trail is kept (ADT lifetime). Source IM 36K10L25-01EN.
|
|
---
|
|
|
|
# Audit trail (R1.05)
|
|
|
|
Re-checked on R1.05 on 2026-10-09 (read-only). IM 36K10L25 4th edition changed only its contact
|
|
information, but the installed software has grown (none of it is in the manual):
|
|
- `AUDIT_TRAIL` has two new fields, `APPROVAL_REASON` (256) and `APPROVER` (128), filled by
|
|
display writes that carry a reason and approver (IM 36K10C50 §2.22, §4.12; ISS-099, ISS-140).
|
|
- 499 classifiers instead of 463: new action `PENDING` and new sources `REST-SERVER`, `PYTOOLS`,
|
|
`PASSWORD-CHECK` (ISS-141).
|
|
- `audit_start.cmd` / `audit_stop.cmd` call extension scripts `?*_audit_start.cmd` /
|
|
`?*_audit_stop.cmd` (ISS-142).
|
|
Processes, `ADT` group, selection-group dataset and `adtsys.sup` keywords are otherwise as on R1.03.
|
|
Paths: read `TLS_*` (`set TLS`); on the R1.05 test server program and data are both under
|
|
`C:\Yokogawa\CIServer\tls`. Skill text still shows R1.03 paths where it names a full path.
|
|
|
|
Background: `knowledge/manuals/IM36K10L25-01EN.md` (processes, classifiers, setup keywords,
|
|
installed findings), `IM36K10G10-01EN.md` ch. 9 (overview), `IM36K10C40-01EN.md` (storage groups),
|
|
`IM36K10P20-01EN.md` (RQL for audit reports).
|
|
|
|
Rules:
|
|
- Run `system-check` first; follow the user's chosen way of working.
|
|
- The audit trail is evidence: single records cannot be deleted, and nothing in these tasks
|
|
deletes them. Changing the `ADT` storage group (lifetime, stop, delete units) loses history —
|
|
only with the user's explicit approval (skill `history-management`).
|
|
- Switching a classifier's `STORAGE` off stops recording that event type: confirm with the user.
|
|
- Setup files in `tls\sup` (`adtsys.sup`, per-process files) need admin rights: hand them to
|
|
the user (skill `portal-setup`, `change-setup-file.md`).
|
|
- Example names come from `CI-Eng-Sample` (selection group `CIENG_ITEMS`, report `CIENG_AUDIT`,
|
|
logger setup file `audit/adtlogci.sup`).
|
|
|
|
| Task | File | Status |
|
|
|---|---|---|
|
|
| Check AUDIT Service: processes, storage group `ADT`, classifier and selection group counts | `tasks/audit-checks.md` | verified (R1.03); verified on R1.05 2026-10-09 (read-only) |
|
|
| Read the audit trail: export, RQL query, audit report, what gets recorded by which tool | `tasks/read-audit-trail.md` | verified (R1.03); on R1.05 RQL read, field list and sources checked 2026-10-09; the sample report load passed 2026-10-08 (load check only) |
|
|
| Approval reason / approver in the audit trail (`APPROVAL_REASON`, `APPROVER`) | `tasks/read-audit-trail.md` §1a | verified on R1.05 that the fields exist and are filled for operator writes; custom alarm acknowledgement not tested (display changes not allowed on the shared server) |
|
|
| Choose what is stored (classifier `STORAGE`), selection groups, event logger `ADTLOG` | `tasks/configure-audit.md` | verified (R1.03, incl. operator-side item value events, ISS-049); on R1.05 files and datasets checked, selection group load passed 2026-10-08; `ADTLOG` not re-run (starting processes not allowed on the shared server) |
|
|
| Distributor process, extra collectors, new classifier entities in C | L25 summary §2, §5 | from docs |
|