Preparing the auditing service

The following preparations are required:

• Customize the AUDTPARM member in the PARM library to configure the auditing service for your system. In the AUDTPARM member you
  • define audit SYSOUTs parameters
  • define audit events

    Each event consists of an action, such as Create or Print, an entity, and an audit level, by which you specify which event records are written to the audit SYSOUT. A user can define several levels of auditing in several EVENT blocks with different levels. However, only the level specified in the LEVEL block by LEVELA is active.

  • specify which missions collect and combine the audit information

    This specification prevents the events of the audit missions from being included in the audit report.

  For more information, see Example 2 - AUDTPARM member.

• Create a decollation mission to collect audit SYSOUTs produced during a specific period. This decollation mission processes the SYSOUTs and creates many reports (one report for each SYSOUT) and stores the intermediate reports in the Control‑D repository. See Example 3 - Decollation mission for collecting audit SYSOUTs.
• Create a printing mission to create one SYSOUT. This printing mission combines the many intermediate reports stored in the Control-D repository and prints one audit SYSOUT for a specified period. See Example 4 - Audit print mission.
• Create a decollation mission to create one audit report for a specific period. This decollation mission processes the audit SYSOUT produced by the printing mission and creates an audit report for a specified period, storing it in the Control-D repository. Control‑V indexes can be created with this decollation mission to provide efficient access to the audit information. See Example 5 - Decollation mission for storing audit report.
• Specify the audit reports in the Housekeeping procedures (Backup and Migrate missions, CTDDELRP, CTVCLMIG, CTDCLHST utilities).

  Table 346 AUDTPARM parameters

  Block	Parameter	Description
  SYSOUT	PORTION	Maximum number of events in one SYSOUT
  	INTERVLA	Maximum time interval between SYSOUTs in HHMMSS format
  	CLASSA	Audit CLASS
  	EXTWTR	External writer name
  	DEST	Printing destination for the audit reports
  	FORM	Printing FORM for the audit reports
  	DECMIS	Specifies the audit decollation missions group - This specification prevents the events of the audit decollation mission from being included in the audit report.
  LEVEL	LEVELA	Audit level. The level can be one of the following: 0 (Disables the audit service.) one of the LEVELE values used by the event definitions in the EVENT blocks
  EVENT	LEVELE	Specifies the level of the event. Events defined with the same level will be registered together for auditing. It is possible to define multiple EVENT blocks with the same LEVELE value. All of the events defined in these EVENT blocks are active if the same value that is specified for LEVELE is also specified for LEVELA.
  	ACTION	Specifies a list of actions (operations), which will be registered for auditing if they are associated with one of the entities specified in the event definition (in the same EVENT block). The valid associations between the actions and entities appear in Event List. The valid action values are: Create Delete Clear View Copy Print Defer_print (Deferred print) Update Backup Migrate MS_migrate (Multistage migrate) Restore Restore_req (Restore request) Order Local_print (on PC) Local_save (on PC) Add_version (of Note) Move E-mail
  	ENTITY	Specifies a list of entities, which will be registered for auditing if they are associated with one of the actions specified in the event definition (in the same EVENT block). The valid associations between the actions and entities appear in Event List. The valid entity values are: Session Report Sysdata Def_report (Default report) Index Data_set Ruler Note Mission Member Tree Element