4.9 KiB
| task | version | source | status |
|---|---|---|---|
| Read the audit trail (export, RQL query, audit report) and know what each tool records | R1.03 | IM 36K10L25-01EN §1.1, §2.1.2, §3.1, App. 1; IM 36K10G10-01EN ch. 9; practiced on CI-Eng-Sample 2026-10-01 | verified |
Read the audit trail
Read-only. Dataset AUDIT_TRAIL (storage group ADT); every field is read-only except
APPLICATION_SUB (the "modifiable ASCII application info") and PROFILE.
1. Fields
| Field | Content |
|---|---|
NAME |
<ACTION_TIME>/<ACTION_STAMP>, e.g. 01-OCT-26 17:05:00.181/84 |
ACTION_TIME, NOTIFICATION_TIME, MODIFICATION_TIME |
When it happened / reached AUDIT Service / APPLICATION_SUB was last changed |
SUBJECT_GROUP |
Subject: the dataset name for configuration and DSS value changes (ITEM_DF, ITEM_VAL, SECTION_DF, REPORT_DF, AUDIT_EVENT_CLAS_DF …) or a classifier subject (CI-SERVER for logins, ITEM, SUB-ITEM …) |
SUBJECT_ATTRIBUTE |
Changed field (HIGH_LIMIT, ITEM_VALUE, DESCRIPTION …); empty for insert/delete/login |
SUBJECT_ACTION |
INSERT, MODIFY, DELETE, LOGIN, LOGOUT, LOGIN-ATTEMPT, ACKNOWLEDGE, SHELVE, UN-SHELVE |
SUBJECT_SOURCE |
Tool that made the change (table in §2) |
SUBJECT_IDENT |
Record name: item, section, object (<object>:<attribute> for attribute values) … |
USER_NAME, PROFILE, TERMINAL |
CI Server user and profile; terminal often empty |
ACTION_NODE/ACTION_PROCESS, NOTIFICATION_NODE/NOTIFICATION_PROCESS |
Node and process (DSSSDA00, JHMISET1086, DSSQLD00875 …) |
OLD_VALUE, NEW_VALUE |
Text, max 64 characters (longer values are cut) |
REASON, APPLICATION_INFO, APPLICATION_SUB |
Free text from the notifying program (empty in the tests) |
2. What is recorded (verified on R1.03.00)
| Action | Recorded as |
|---|---|
dssqld load / modify / remove (any dataset) |
<DATASET>, field, INSERT/MODIFY/DELETE, source ENT-ENG-MOD, user FULL AUTHORIZATION, plus a CI-SERVER LOGIN/LOGOUT pair per dssqld run (not QUICKLOAD) |
Writing a value through DSS (dssqld -m on ITEM_VAL) |
ITEM_VAL ITEM_VALUE MODIFY, old and new value — for every item, whatever its Audit trailing wanted (AUDIT_INFO) |
| Engineering Module: change an item field | ITEM_DF <FIELD> MODIFY, source LOC-ENG-MOD, user ADMIN (the logged-in user) |
| Engineering Module: right-click item › Update value | ITEM_VAL ITEM_VALUE_STR MODIFY (old/new) and ITEM_VAL STATUS MODIFY, source LOC-ENG-MOD |
| Engineering Module / Operator / OPC UA server login | CI-SERVER LOGIN / LOGOUT, source LOC-ENG-MOD, OPER-INTERFACE, VIA-OPC-UAS |
itmval -p (ITEM Service API) |
nothing, even with AUDIT_INFO 1 |
The ITEM.VALUE.MODIFY.* style classifiers (subject ITEM) were not produced by any of these
tools; they are expected from operator displays and PROCESS Service on items with
AUDIT_INFO 1 (open: ISS-049). The SUBJECT_SOURCE of a user interface comes from its audit
trail id in dssana.sup USER_INTERFACE (Engineering Module = LOC-ENG-MOD).
3. Export
dssqld -e skips AUDIT_TRAIL in a full export (NO-EXPORT in dssqld.sup); name it:
dssqld -e audit.qlo -d AUDIT_TRAIL
or filter (dates as dd-mm-yyyy hh:mm:ss, local time):
@FIELDS
NAME,SUBJECT_GROUP,SUBJECT_ATTRIBUTE,SUBJECT_ACTION,SUBJECT_SOURCE,SUBJECT_IDENT,USER_NAME,OLD_VALUE,NEW_VALUE
@SELECT
'SUBJECT_IDENT = "<Section>.<Tag>" AND ACTION_TIME > "01-10-2026 17:00:00"'
@AUDIT_TRAIL
dssqld -e out.csv audit.qli -c (CSV). Keep NAME in @FIELDS: without the key field the
export silently returns 0 records (verified). The whole trail can be large (5 000 records after a
year of test work). Wildcards: SUBJECT_IDENT LIKE "<Section>.*" (*, not %; = with *
matches nothing).
4. RQL query and audit report
column t as 'DD-MM-YYYY hh:mm:ss' heading 'Time';
select action_time t, subject_group, subject_attribute, subject_action, subject_source,
subject_ident, user_name, old_value, new_value
from audit_trail
where action_time > @date - 3600 and subject_ident like '<Section>.%'
order by action_time;
Use aliases with COLUMN … AS 'A12' to keep lines short (the fields are 16–256 characters
wide). Try it in the interactive generator (skill reporting, rql-interactive.md). The sample
report CIENG_AUDIT (examples/CI-Eng-Sample/19_audit_df.qli) lists the last hour of events on
CI-Eng-Sample.*; generate it like any ad-hoc report (define-reports.md §2). Generated from
dssqld it is stored but not printed (FSL-E-PRT_UNKUSER, ISS-045).
In the Engineering Module, Configuration › Reporting › Reports holds the system reports
AUDIT_TRAIL and UA_SERVER_AUDIT (IM 36K10C30 App. 1). Generated there (as the logged-in
user) CIENG_AUDIT printed to CIENG_FILE and showed in the report viewer (checked by the user).