85 lines
4.7 KiB
Markdown
85 lines
4.7 KiB
Markdown
---
|
||
task: Read the audit trail (export, RQL query, audit report) and know what each tool records
|
||
version: R1.03
|
||
source: IM 36K10L25-01EN §1.1, §2.1.2, §3.1, App. 1; IM 36K10G10-01EN ch. 9; practiced on CI-Eng-Sample 2026-10-01
|
||
status: verified
|
||
---
|
||
|
||
# Read the audit trail
|
||
|
||
Read-only. Dataset `AUDIT_TRAIL` (storage group `ADT`); every field is read-only except
|
||
`APPLICATION_SUB` (the "modifiable ASCII application info") and `PROFILE`.
|
||
|
||
## 1. Fields
|
||
|
||
| Field | Content |
|
||
|---|---|
|
||
| `NAME` | `<ACTION_TIME>/<ACTION_STAMP>`, e.g. `01-OCT-26 17:05:00.181/84` |
|
||
| `ACTION_TIME`, `NOTIFICATION_TIME`, `MODIFICATION_TIME` | When it happened / reached AUDIT Service / `APPLICATION_SUB` was last changed |
|
||
| `SUBJECT_GROUP` | Subject: the **dataset name** for configuration and DSS value changes (`ITEM_DF`, `ITEM_VAL`, `SECTION_DF`, `REPORT_DF`, `AUDIT_EVENT_CLAS_DF` …) or a classifier subject (`CI-SERVER` for logins, `ITEM`, `SUB-ITEM` …) |
|
||
| `SUBJECT_ATTRIBUTE` | Changed field (`HIGH_LIMIT`, `ITEM_VALUE`, `DESCRIPTION` …); empty for insert/delete/login |
|
||
| `SUBJECT_ACTION` | `INSERT`, `MODIFY`, `DELETE`, `LOGIN`, `LOGOUT`, `LOGIN-ATTEMPT`, `ACKNOWLEDGE`, `SHELVE`, `UN-SHELVE` |
|
||
| `SUBJECT_SOURCE` | Tool that made the change (table in §2) |
|
||
| `SUBJECT_IDENT` | Record name: item, section, object (`<object>:<attribute>` for attribute values) … |
|
||
| `USER_NAME`, `PROFILE`, `TERMINAL` | CI Server user and profile; terminal often empty |
|
||
| `ACTION_NODE`/`ACTION_PROCESS`, `NOTIFICATION_NODE`/`NOTIFICATION_PROCESS` | Node and process (`DSSSDA00`, `JHMISET1086`, `DSSQLD00875` …) |
|
||
| `OLD_VALUE`, `NEW_VALUE` | Text, max 64 characters (longer values are cut) |
|
||
| `REASON`, `APPLICATION_INFO`, `APPLICATION_SUB` | Free text from the notifying program (empty in the tests) |
|
||
|
||
## 2. What is recorded (verified on R1.03.00)
|
||
|
||
| Action | Recorded as |
|
||
|---|---|
|
||
| `dssqld` load / modify / remove (any dataset) | `<DATASET>`, field, `INSERT`/`MODIFY`/`DELETE`, source **`ENT-ENG-MOD`**, user `FULL AUTHORIZATION`, plus a `CI-SERVER` `LOGIN`/`LOGOUT` pair per `dssqld` run (not `QUICKLOAD`) |
|
||
| Writing a value through DSS (`dssqld -m` on `ITEM_VAL`) | `ITEM_VAL` `ITEM_VALUE` `MODIFY`, old and new value — for **every** item, whatever its *Audit trailing wanted* (`AUDIT_INFO`) |
|
||
| Engineering Module: change an item field | `ITEM_DF` `<FIELD>` `MODIFY`, source `LOC-ENG-MOD`, user `ADMIN` (the logged-in user) |
|
||
| Engineering Module: right-click item › *Update value* | `ITEM_VAL` `ITEM_VALUE_STR` `MODIFY` (old/new) and `ITEM_VAL` `STATUS` `MODIFY`, source `LOC-ENG-MOD` |
|
||
| Engineering Module / Operator / OPC UA server login | `CI-SERVER` `LOGIN` / `LOGOUT`, source `LOC-ENG-MOD`, `OPER-INTERFACE`, `VIA-OPC-UAS` |
|
||
| `itmval -p` (ITEM Service API) | **nothing**, even with `AUDIT_INFO` 1 |
|
||
|
||
The `ITEM.VALUE.MODIFY.*` style classifiers (subject `ITEM`) were not produced by any of these
|
||
tools; they are expected from operator displays and PROCESS Service on items with
|
||
`AUDIT_INFO` 1 (open: ISS-049). The `SUBJECT_SOURCE` of a user interface comes from its *audit
|
||
trail id* in `dssana.sup` `USER_INTERFACE` (Engineering Module = `LOC-ENG-MOD`).
|
||
|
||
## 3. Export
|
||
|
||
`dssqld -e` skips `AUDIT_TRAIL` in a full export (`NO-EXPORT` in `dssqld.sup`); name it:
|
||
|
||
```
|
||
dssqld -e audit.qlo -d AUDIT_TRAIL
|
||
```
|
||
|
||
or filter (dates as `dd-mm-yyyy hh:mm:ss`, local time):
|
||
|
||
```
|
||
@FIELDS
|
||
NAME,SUBJECT_GROUP,SUBJECT_ATTRIBUTE,SUBJECT_ACTION,SUBJECT_SOURCE,SUBJECT_IDENT,USER_NAME,OLD_VALUE,NEW_VALUE
|
||
@SELECT
|
||
'SUBJECT_IDENT = "<Section>.<Tag>" AND ACTION_TIME > "01-10-2026 17:00:00"'
|
||
@AUDIT_TRAIL
|
||
```
|
||
|
||
`dssqld -e out.csv audit.qli -c` (CSV). **Keep `NAME` in `@FIELDS`**: without the key field the
|
||
export silently returns 0 records (verified). The whole trail can be large (5 000 records after a
|
||
year of test work). Wildcards: `SUBJECT_IDENT LIKE "<Section>.*"` (`*`, not `%`; `=` with `*`
|
||
matches nothing).
|
||
|
||
## 4. RQL query and audit report
|
||
|
||
```
|
||
column t as 'DD-MM-YYYY hh:mm:ss' heading 'Time';
|
||
select action_time t, subject_group, subject_attribute, subject_action, subject_source,
|
||
subject_ident, user_name, old_value, new_value
|
||
from audit_trail
|
||
where action_time > @date - 3600 and subject_ident like '<Section>.%'
|
||
order by action_time;
|
||
```
|
||
|
||
Use aliases with `COLUMN … AS 'A12'` to keep lines short (the fields are 16–256 characters
|
||
wide). Try it in the interactive generator (skill `reporting`, `rql-interactive.md`). The sample
|
||
report `CIENG_AUDIT` (`examples/CI-Eng-Sample/19_audit_df.qli`) lists the last hour of events on
|
||
`CI-Eng-Sample.*`; generate it like any ad-hoc report (`define-reports.md` §2). Generated from
|
||
`dssqld` it is stored but not printed (`FSL-E-PRT_UNKUSER`, ISS-045).
|
||
|
||
The Engineering Module also has the system report `AUDIT_TRAIL` (IM 36K10C30 App. 1).
|