ci-server-engineer/.claude/skills/audit-trail/tasks/audit-checks.md

---

task: Check AUDIT Service (processes, storage group ADT, classifiers, selection groups) version: R1.05 (first written for R1.03) source: IM 36K10L25-01EN §1.2, §2.1.1, §2.3.1, §4.1 (4th ed., Feb. 2026; text unchanged from the 3rd ed.); practiced on the test system 2026-10-01 status: verified on R1.03 (2026-10-01); verified on the R1.05 test server 2026-10-09 (read-only: processes, ADT group, classifier and selection group exports, start scripts, setup files)

AUDIT Service checks

All read-only.

1. Processes

tasklist /FI "IMAGENAME eq adt*"
durwfp -p adtsto -t 0      (errorlevel 0 = running)

Default (tls\com\audit_start.cmd): adtsto.exe (storage, process ADTSTO) and adtcol.exe (collector ADTCOL01). AUDIT Service starts after HISTORY Service and refuses to start when his is not running; ADTCOL01 exits if storage group ADT does not exist (first start: ADTSTO creates it). adtdst (distributor), adtlog (event logger) and adtcol02 are only in commented lines. Stop: audit_stop.cmd (durstp on adt*, admin).

R1.05 (verified 2026-10-09): same two processes running, adtlog and adtdst not running (durwfp 1). New in R1.05: audit_start.cmd ends by calling every %TLS_ROOT_PATH%\tls\com\?*_audit_start.cmd, and audit_stop.cmd calls every ?*_audit_stop.cmd before it stops the adt* processes (ISS-142; same hook pattern as the other start scripts, ISS-121). Use such a file for your own additions (e.g. a permanent ADTLOG) instead of editing the product script. Not described in IM 36K10L25.

2. Storage group ADT

@FIELDS
NAME,LIFE_TIME,ROLLOVER_INT,START_TIME,STOP_TIME,TYPE
@SELECT
'NAME = "ADT"'
@HIS_GROUP_DF

dssqld -e adt.qlo adt.qli. History type 6 (audit). Manual default when ADTSTO creates it: rollover 1 day, unit lifetime 2 days; the R1.03 test system and the R1.05 test server both had 52 weeks lifetime, rollover 1 day (type shown as Audit in the export). While storage of ADT is stopped, new events are refused (logged via UMH). Unit details: skill history-management, history-checks.md.

3. Classifiers and selection groups

dssqld -e ecl.qlo -d AUDIT_EVENT_CLAS_DF
dssqld -e sgp.qlo -d AUDIT_SELGRP_DF

R1.03.00 test system: 463 classifiers (BASIC_SET 1), 444 with STORAGE 1. Off by default: everything from source COMPUTE (PROCESS Service) on ITEM/SUB-ITEM values, status, quality, limits and deadband, and DATASET.NULL-ATTR.*.COMPUTE. No selection groups exist until you create one (the file tls\dat\adt_sgp.dat is created empty by ADTSTO).

R1.05 test server (2026-10-09): 499 classifiers, all BASIC_SET 1, 478 with STORAGE 1. The 36 extra ones are exactly the new action and sources (ISS-141): PENDING on ITEM.VALUE / ITEM.STATUS (sources HMI, LOC-ENG-MOD, OPER-INTERFACE, OTHERS, VIA-OPC-UAS, COMPUTE), and REST-SERVER, PYTOOLS, PASSWORD-CHECK on CI-SERVER login / logout / login attempt and DATASET insert / modify / delete, plus ITEM.VALUE, STATUS, QUALITY-CODE MODIFY for REST-SERVER and PYTOOLS. Off: the same 19 COMPUTE classifiers as on R1.03 plus ITEM.VALUE.PENDING.COMPUTE and ITEM.STATUS.PENDING.COMPUTE. (463 + 36 = 499 and 19 + 2 = 21 off; the R1.03 list itself is not kept in the repo.) No selection groups on the R1.05 test server.

Files: %TLS_DAT_PATH%\adt_ecl.* (classifiers), adt_sgp.* (selection groups); audit records are in the history files of group ADT (%TLS_HIS_PATH%).

4. Setup files

Only tls\sup\adtsys.sup is installed (QUESIZE = 200, the rest commented): it is the keyword reference and template. A process reads a setup file named after itself (adtsto.sup, adtcol01.sup, adtlog.sup …) if present. Keywords: configure-audit.md §4 and the L25 summary.

R1.05 (2026-10-09): adtsys.sup / adtsys.tpl differ from R1.03 only by two new E_LAYOUT units APPRR (approval reason) and APPR (approver) (ISS-140). adtini.sup differs only in the licence lines; fmfprt.sup and the AUDIT_EVENT_CLAS_DF / AUDIT_SELGRP_DF dataset definitions are identical; dssqld.sup still has NO-EXPORT=AUDIT_TRAIL.