cliu cfc48a888d Add audit-trail skill

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-01 17:15:27 +10:00

2.2 KiB

Raw Blame History

task	version	source	status
Check AUDIT Service (processes, storage group ADT, classifiers, selection groups)	R1.03	IM 36K10L25-01EN §1.2, §2.1.1, §2.3.1, §4.1; practiced on the test system 2026-10-01	verified

AUDIT Service checks

All read-only.

1. Processes

tasklist /FI "IMAGENAME eq adt*"
durwfp -p adtsto -t 0      (errorlevel 0 = running)

Default (tls\com\audit_start.cmd): adtsto.exe (storage, process ADTSTO) and adtcol.exe (collector ADTCOL01). AUDIT Service starts after HISTORY Service and refuses to start when his is not running; ADTCOL01 exits if storage group ADT does not exist (first start: ADTSTO creates it). adtdst (distributor), adtlog (event logger) and adtcol02 are only in commented lines. Stop: audit_stop.cmd (durstp on adt*, admin).

2. Storage group `ADT`

@FIELDS
NAME,LIFE_TIME,ROLLOVER_INT,START_TIME,STOP_TIME,TYPE
@SELECT
'NAME = "ADT"'
@HIS_GROUP_DF

dssqld -e adt.qlo adt.qli. History type 6 (audit). Manual default when ADTSTO creates it: rollover 1 day, unit lifetime 2 days; the test system had 52 weeks lifetime, rollover 1 day. While storage of ADT is stopped, new events are refused (logged via UMH). Unit details: skill history-management, history-checks.md.

3. Classifiers and selection groups

dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF
dssqld -e sgp.qlo -d AUDIT_SELGRP_DF

R1.03.00 test system: 463 classifiers (BASIC_SET 1), 444 with STORAGE 1. Off by default: everything from source COMPUTE (PROCESS Service) on ITEM/SUB-ITEM values, status, quality, limits and deadband, and DATASET.NULL-ATTR.*.COMPUTE. No selection groups exist until you create one (the file tls\dat\adt_sgp.dat is created empty by ADTSTO).

Files: %TLS_DAT_PATH%\adt_ecl.* (classifiers), adt_sgp.* (selection groups); audit records are in the history files of group ADT (%TLS_HIS_PATH%).

4. Setup files

Only tls\sup\adtsys.sup is installed (QUESIZE = 200, the rest commented): it is the keyword reference and template. A process reads a setup file named after itself (adtsto.sup, adtcol01.sup, adtlog.sup …) if present. Keywords: configure-audit.md §4 and the L25 summary.

2.2 KiB Raw Blame History