39 lines
2.5 KiB
Markdown
39 lines
2.5 KiB
Markdown
---
|
|
name: audit-trail
|
|
description: >-
|
|
CI Server R1.03 AUDIT Service and audit trail. Use when the user wants to know who changed
|
|
what and when (item value written, limit or description changed, item / section / object /
|
|
report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read
|
|
or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user,
|
|
source HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / ODBC / QUICKLOAD), make an audit
|
|
report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF,
|
|
STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection
|
|
groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events
|
|
(ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol,
|
|
adtdst, audit_start), or change how long the audit trail is kept (ADT lifetime). Source
|
|
IM 36K10L25-01EN.
|
|
---
|
|
|
|
# Audit trail (R1.03)
|
|
|
|
Background: `knowledge/manuals/IM36K10L25-01EN.md` (processes, classifiers, setup keywords,
|
|
installed findings), `IM36K10G10-01EN.md` ch. 9 (overview), `IM36K10C40-01EN.md` (storage groups),
|
|
`IM36K10P20-01EN.md` (RQL for audit reports).
|
|
|
|
Rules:
|
|
- Run `system-check` first; follow the user's chosen way of working.
|
|
- The audit trail is evidence: single records cannot be deleted, and nothing in these tasks
|
|
deletes them. Changing the `ADT` storage group (lifetime, stop, delete units) loses history —
|
|
only with the user's explicit approval (skill `history-management`).
|
|
- Switching a classifier's `STORAGE` off stops recording that event type: confirm with the user.
|
|
- Setup files in `tls\sup` (`adtsys.sup`, per-process files) need admin rights: hand them to
|
|
the user (skill `portal-setup`, `change-setup-file.md`).
|
|
- Example names come from `CI-Eng-Sample` (selection group `CIENG_ITEMS`, report `CIENG_AUDIT`,
|
|
logger setup file `audit/adtlogci.sup`).
|
|
|
|
| Task | File | Status |
|
|
|---|---|---|
|
|
| Check AUDIT Service: processes, storage group `ADT`, classifier and selection group counts | `tasks/audit-checks.md` | verified |
|
|
| Read the audit trail: export, RQL query, audit report, what gets recorded by which tool | `tasks/read-audit-trail.md` | verified |
|
|
| Choose what is stored (classifier `STORAGE`), selection groups, event logger `ADTLOG` | `tasks/configure-audit.md` | verified (operator-side item value events from docs, ISS-049) |
|
|
| Distributor process, extra collectors, new classifier entities in C | L25 summary §2, §5 | from docs |
|