File Manager audit records

This section describes the structure of, and information recorded in, File Manager audit records.

An audit log record may occupy one or more physical records in the audit file. When an audit log record requires two or more physical records, the second and subsequent log records are continuation records.

Part 1 - record header

Audit record: Header shows the information contained in the record header. The record header is at the start of each physical record that makes up the audit log record.

Table 1. Audit record: Header

This table has six columns. In the header, "Offsets" spans two columns, with subheadings "Dec" and "Hex". In the table, the second to seventh rows have five columns. The third column, which indicates a bit position, spans two columns.

Offsets		Type	Len	Name (Dim)	Description
Dec	Hex
0	(0)	BIT(8)	1	LOG_FLAGS	Log flags
		1... ....		LOG_CONT	Continuation indicator
		.1.. ....		LOG_IMS	Log record for FM/IMS
		..1. ....		LOG_DB2	Log record for FM/Db2
		...1 ....		LOG_CICS	Log record for FM/CICS
		.... 111.		*
		.... ...1		LOG_V2IND	Log record Version 2 or later
1	(1)	UNSIGNED BINARY	1	LOG_VERSION	Version number
2	(2)	UNSIGNED BINARY	4	LOG_RECNUM	Record count within the current audit session
6	(6)	CHARACTER	5	LOG_ID	Log record constant 'FMIMS' (IMS™ eyecatcher) 'FMDB2' (Db2® eyecatcher) 'FMCIC' (CICS® eyecatcher) 'FMLOG' (base eyecatcher)
11	(B)	CHARACTER	3	*
14	(E)	UNSIGNED PACKED DECIMAL	4	LOG_DATE	Date - yyyymmdd
18	(12)	UNSIGNED PACKED DECIMAL	4	LOG_TIME	Time - hhmmssth
22	(16)	CHARACTER	8	LOG_SYSID	MVS™ system ID (CVTSNAME)
30	(1E)	CHARACTER	8	LOG_USERID	Userid
38	(26)	CHARACTER	8	LOG_SSID	FM/Db2 System ID, IMS Subsystem name, or CICS® Applid
46	(2E)	CHARACTER	8	LOG_JOBNAME	Job Name
54	(36)	CHARACTER	8	LOG_JOBID	Job ID
62	(3E)	CHARACTER	1	LOG_SESSID	Session ID
63	(3F)	CHARACTER	8	LOG_FUNCOD	File Manager function code
71	(47)	CHARACTER	8	LOG_DBNAME	IMS™ Database name
79	(4F)	CHARACTER	23	*

Part 2 - data item reference section

The data item reference section is in the first physical record of the audit record, immediately after the audit record header. It consists of 2 parts: the data item reference header, followed by the data item reference array. Audit record: Data item reference header shows the information contained in the data item reference header.

Table 2. Audit record: Data item reference header

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets		Type	Len	Name (Dim)	Description
Dec	Hex
102	(66)	UNSIGNED BINARY	2	LOG_ITEM_CNT	Number of data items in the data section of the audit record.
104	(68)	UNSIGNED BINARY	2	LOG_REC_COUNT	Number of physical records required to write the audit log record. A value greater than 1 implies there are continuation records.

The data item reference array is an array of entries. Each entry describes a single data item. The LOG_ITEM_CNT value in the data item reference header (see Audit record: Data item reference header) specifies the number of elements in the array.

Audit record: Data item reference section shows the information contained in a data item reference array element.

Table 3. Audit record: Data item reference section

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets		Type	Len	Name (Dim)	Description
Dec	Hex
0	(0)	STRUCTURE	8	LOG_DATA_ITEM(*)
0	(0)	UNSIGNED BINARY	2	LOG_ITEM_CODE	Item data code. See Data items common to all audit records.
2	(2)	CHARACTER	1	LOG_DATATYPE	Data type code. See Data item types common to all audit records.
3	(3)	CHARACTER	1	*	Reserved/filler
4	(4)	SIGNED BINARY	4	LOG_ITEM_DATLEN	Fullword length

Part 3 - data section

The data section contains all of the data for the various data items defined in the data item reference section of the record. Each data item is stored in sequence and occupies exactly the length given in the data item reference section. There are no space bytes between data items.

The data items depend on the File Manager component and the record type. In general terms, each record type is associated with some data items that are always written, followed by some data items that are specific to the record type and the component that is in use.

Audit record: Data section shows the information contained in the data section:

Table 4. Audit record: Data section

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets		Type	Len	Name (Dim)	Description
Dec	Hex
0	(0)	STRUCTURE	*	LOG_DATAAREA
0	(0)	UNSIGNED BINARY	2	LOG_DATALEN	Length of LOG_DATA
2	(2)	STRUCTURE	*	LOG_DATA	logging data

Note: For continuation records, the data for the incomplete data item continues from the previous record, immediately after the continuation record header, as shown in Audit record: continued record.

Table 5. Audit record: continued record

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets		Type	Len	Name (Dim)	Description
Dec	Hex
0	(0)	CHARACTER	102	LOG_HEADER_FIXED	The Audit record header (see Audit record: Header)
102	(66)	UNSIGNED BINARY	2	LOG_CONT_LEN	Length of continued data
104	(68)	CHARACTER	*	LOG_CONT_DATA	The data for the incomplete data item (and possibly other data items)