59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
---
|
|
task: Check AUDIT Service (processes, storage group ADT, classifiers, selection groups)
|
|
version: R1.03
|
|
source: IM 36K10L25-01EN §1.2, §2.1.1, §2.3.1, §4.1; practiced on the test system 2026-10-01
|
|
status: verified
|
|
---
|
|
|
|
# AUDIT Service checks
|
|
|
|
All read-only.
|
|
|
|
## 1. Processes
|
|
|
|
```
|
|
tasklist /FI "IMAGENAME eq adt*"
|
|
durwfp -p adtsto -t 0 (errorlevel 0 = running)
|
|
```
|
|
|
|
Default (`tls\com\audit_start.cmd`): `adtsto.exe` (storage, process `ADTSTO`) and `adtcol.exe`
|
|
(collector `ADTCOL01`). AUDIT Service starts after HISTORY Service and refuses to start when
|
|
`his` is not running; `ADTCOL01` exits if storage group `ADT` does not exist (first start:
|
|
`ADTSTO` creates it). `adtdst` (distributor), `adtlog` (event logger) and `adtcol02` are only in
|
|
commented lines. Stop: `audit_stop.cmd` (`durstp` on `adt*`, admin).
|
|
|
|
## 2. Storage group `ADT`
|
|
|
|
```
|
|
@FIELDS
|
|
NAME,LIFE_TIME,ROLLOVER_INT,START_TIME,STOP_TIME,TYPE
|
|
@SELECT
|
|
'NAME = "ADT"'
|
|
@HIS_GROUP_DF
|
|
```
|
|
|
|
`dssqld -e adt.qlo adt.qli`. History type 6 (audit). Manual default when `ADTSTO` creates it:
|
|
rollover 1 day, unit lifetime 2 days; the test system had **52 weeks** lifetime, rollover
|
|
1 day. While storage of `ADT` is stopped, new events are refused (logged via UMH). Unit
|
|
details: skill `history-management`, `history-checks.md`.
|
|
|
|
## 3. Classifiers and selection groups
|
|
|
|
```
|
|
dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF
|
|
dssqld -e sgp.qlo -d AUDIT_SELGRP_DF
|
|
```
|
|
|
|
R1.03.00 test system: 463 classifiers (`BASIC_SET` 1), 444 with `STORAGE` 1. Off by default:
|
|
everything from source `COMPUTE` (PROCESS Service) on `ITEM`/`SUB-ITEM` values, status,
|
|
quality, limits and deadband, and `DATASET.NULL-ATTR.*.COMPUTE`. No selection groups exist
|
|
until you create one (the file `tls\dat\adt_sgp.dat` is created empty by `ADTSTO`).
|
|
|
|
Files: `%TLS_DAT_PATH%\adt_ecl.*` (classifiers), `adt_sgp.*` (selection groups); audit records
|
|
are in the history files of group `ADT` (`%TLS_HIS_PATH%`).
|
|
|
|
## 4. Setup files
|
|
|
|
Only `tls\sup\adtsys.sup` is installed (`QUESIZE = 200`, the rest commented): it is the keyword
|
|
reference and template. A process reads a setup file named after itself (`adtsto.sup`,
|
|
`adtcol01.sup`, `adtlog.sup` …) if present. Keywords: `configure-audit.md` §4 and the L25 summary.
|