cliu bf7d88a027 R1.05 re-check batch 3: alarms, audit, authorization, classes, HAC, reporting, pyTOOLS

Full manual diffs (L15, C20, E30, L25, J40, C10 §2, L10, P10, P11, J20,
C30, P20, R40, E10) and read-only checks on the shared R1.05 test server.
Skills and summaries moved to R1.05; new skill pytools (IM 36K10P40) from
docs (no Python on the test server). Issues ISS-132..181; corrections to
version-differences (E10, E30, P11, dss_ath_grp_u0104); C10 summary lists
the 3 new authorization actions; r105-verification V10-V17.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-09 10:21:36 +11:00

4.2 KiB

Raw Blame History

name	description
audit-trail	CI Server R1.05 AUDIT Service and audit trail. Use when the user wants to know who changed what and when (item value written, limit or description changed, item / section / object / report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user, approval reason and approver of a change (APPROVAL_REASON, APPROVER, FDA Part 11), source HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / REST-SERVER / PYTOOLS / PASSWORD-CHECK / ODBC / QUICKLOAD, PENDING item writes), make an audit report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF, STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events (ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol, adtdst, audit_start, ?*_audit_start.cmd extension scripts), or change how long the audit trail is kept (ADT lifetime). Source IM 36K10L25-01EN.

name

description

audit-trail

CI Server R1.05 AUDIT Service and audit trail. Use when the user wants to know who changed what and when (item value written, limit or description changed, item / section / object / report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user, approval reason and approver of a change (APPROVAL_REASON, APPROVER, FDA Part 11), source HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / REST-SERVER / PYTOOLS / PASSWORD-CHECK / ODBC / QUICKLOAD, PENDING item writes), make an audit report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF, STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events (ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol, adtdst, audit_start, ?*_audit_start.cmd extension scripts), or change how long the audit trail is kept (ADT lifetime). Source IM 36K10L25-01EN.

Audit trail (R1.05)

Re-checked on R1.05 on 2026-10-09 (read-only). IM 36K10L25 4th edition changed only its contact information, but the installed software has grown (none of it is in the manual):

AUDIT_TRAIL has two new fields, APPROVAL_REASON (256) and APPROVER (128), filled by display writes that carry a reason and approver (IM 36K10C50 §2.22, §4.12; ISS-099, ISS-140).
499 classifiers instead of 463: new action PENDING and new sources REST-SERVER, PYTOOLS, PASSWORD-CHECK (ISS-141).
audit_start.cmd / audit_stop.cmd call extension scripts ?*_audit_start.cmd / ?*_audit_stop.cmd (ISS-142). Processes, ADT group, selection-group dataset and adtsys.sup keywords are otherwise as on R1.03. Paths: read TLS_* (set TLS); on the R1.05 test server program and data are both under C:\Yokogawa\CIServer\tls. Skill text still shows R1.03 paths where it names a full path.

Background: knowledge/manuals/IM36K10L25-01EN.md (processes, classifiers, setup keywords, installed findings), IM36K10G10-01EN.md ch. 9 (overview), IM36K10C40-01EN.md (storage groups), IM36K10P20-01EN.md (RQL for audit reports).

Rules:

Run system-check first; follow the user's chosen way of working.
The audit trail is evidence: single records cannot be deleted, and nothing in these tasks deletes them. Changing the ADT storage group (lifetime, stop, delete units) loses history — only with the user's explicit approval (skill history-management).
Switching a classifier's STORAGE off stops recording that event type: confirm with the user.
Setup files in tls\sup (adtsys.sup, per-process files) need admin rights: hand them to the user (skill portal-setup, change-setup-file.md).
Example names come from CI-Eng-Sample (selection group CIENG_ITEMS, report CIENG_AUDIT, logger setup file audit/adtlogci.sup).

Task	File	Status
Check AUDIT Service: processes, storage group `ADT`, classifier and selection group counts	`tasks/audit-checks.md`	verified (R1.03); verified on R1.05 2026-10-09 (read-only)
Read the audit trail: export, RQL query, audit report, what gets recorded by which tool	`tasks/read-audit-trail.md`	verified (R1.03); on R1.05 RQL read, field list and sources checked 2026-10-09; the sample report load passed 2026-10-08 (load check only)
Approval reason / approver in the audit trail (`APPROVAL_REASON`, `APPROVER`)	`tasks/read-audit-trail.md` §1a	verified on R1.05 that the fields exist and are filled for operator writes; custom alarm acknowledgement not tested (display changes not allowed on the shared server)
Choose what is stored (classifier `STORAGE`), selection groups, event logger `ADTLOG`	`tasks/configure-audit.md`	verified (R1.03, incl. operator-side item value events, ISS-049); on R1.05 files and datasets checked, selection group load passed 2026-10-08; `ADTLOG` not re-run (starting processes not allowed on the shared server)
Distributor process, extra collectors, new classifier entities in C	L25 summary §2, §5	from docs

4.2 KiB Raw Blame History

Audit trail (R1.05)

4.2 KiB

Raw Blame History