ci-server-engineer/.claude/skills/audit-trail/SKILL.md

name

description

audit-trail

CI Server R1.03 AUDIT Service and audit trail. Use when the user wants to know who changed what and when (item value written, limit or description changed, item / section / object / report inserted or deleted, login, logout, failed login, alarm acknowledged or shelved), read or export the audit trail (AUDIT_TRAIL dataset, storage group ADT, old value / new value, user, source HMI / LOC-ENG-MOD / ENT-ENG-MOD / OPER-INTERFACE / ODBC / QUICKLOAD), make an audit report, switch auditing of an event type on or off (event classifiers, AUDIT_EVENT_CLAS_DF, STORAGE, "Audit trailing wanted" / AUDIT_INFO on an item), filter audit events (selection groups, AUDIT_SELGRP_DF, expression sbid / sbgp / user / nval), print or log audit events (ADTLOG event logger, adtsys.sup, E_LAYOUT, SEL_GROUP), check AUDIT Service (adtsto, adtcol, adtdst, audit_start), or change how long the audit trail is kept (ADT lifetime). Source IM 36K10L25-01EN.

Audit trail (R1.03)

Background: knowledge/manuals/IM36K10L25-01EN.md (processes, classifiers, setup keywords, installed findings), IM36K10G10-01EN.md ch. 9 (overview), IM36K10C40-01EN.md (storage groups), IM36K10P20-01EN.md (RQL for audit reports).

Rules:

• Run system-check first; follow the user's chosen way of working.
• The audit trail is evidence: single records cannot be deleted, and nothing in these tasks deletes them. Changing the ADT storage group (lifetime, stop, delete units) loses history — only with the user's explicit approval (skill history-management).
• Switching a classifier's STORAGE off stops recording that event type: confirm with the user.
• Setup files in tls\sup (adtsys.sup, per-process files) need admin rights: hand them to the user (skill portal-setup, change-setup-file.md).
• Example names come from CI-Eng-Sample (selection group CIENG_ITEMS, report CIENG_AUDIT, logger setup file audit/adtlogci.sup).

Task	File	Status
Check AUDIT Service: processes, storage group ADT, classifier and selection group counts	tasks/audit-checks.md	verified
Read the audit trail: export, RQL query, audit report, what gets recorded by which tool	tasks/read-audit-trail.md	verified
Choose what is stored (classifier STORAGE), selection groups, event logger ADTLOG	tasks/configure-audit.md	verified (operator-side item value events from docs, ISS-049)
Distributor process, extra collectors, new classifier entities in C	L25 summary §2, §5	from docs