File Manager audit records

This section describes the structure of, and information recorded in, File Manager audit records.

An audit log record may occupy one or more physical records in the audit file. When an audit log record requires two or more physical records, the second and subsequent log records are continuation records.

Each File Manager audit record consists of three parts:
  • Record header
  • Data item reference section
  • Data section
Part 1 - record header
Audit record: Header shows the information contained in the record header. The record header is at the start of each physical record that makes up the audit log record.
Table 1. Audit record: Header

This table has six columns. In the header, "Offsets" spans two columns, with subheadings "Dec" and "Hex". In the table, the second to seventh rows have five columns. The third column, which indicates a bit position, spans two columns.

Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) BIT(8) 1 LOG_FLAGS Log flags
1... .... LOG_CONT Continuation indicator
.1.. .... LOG_IMS Log record for FM/IMS
..1. .... LOG_DB2 Log record for FM/Db2
...1 .... LOG_CICS Log record for FM/CICS
.... 111. *
.... ...1 LOG_V2IND Log record Version 2 or later
1 (1) UNSIGNED BINARY 1 LOG_VERSION Version number
2 (2) UNSIGNED BINARY 4 LOG_RECNUM Record count within the current audit session
6 (6) CHARACTER 5 LOG_ID Log record constant

'FMIMS' (IMS eyecatcher)
'FMDB2' (Db2® eyecatcher)
'FMCIC' (CICS® eyecatcher)
'FMLOG' (base eyecatcher)

11 (B) CHARACTER 3 *
14 (E) UNSIGNED PACKED DECIMAL 4 LOG_DATE Date - yyyymmdd
18 (12) UNSIGNED PACKED DECIMAL 4 LOG_TIME Time - hhmmssth
22 (16) CHARACTER 8 LOG_SYSID MVS system ID (CVTSNAME)
30 (1E) CHARACTER 8 LOG_USERID Userid
38 (26) CHARACTER 8 LOG_SSID FM/Db2 System ID, IMS Subsystem name, or CICS® Applid
46 (2E) CHARACTER 8 LOG_JOBNAME Job Name
54 (36) CHARACTER 8 LOG_JOBID Job ID
62 (3E) CHARACTER 1 LOG_SESSID Session ID
63 (3F) CHARACTER 8 LOG_FUNCOD File Manager function code
71 (47) CHARACTER 8 LOG_DBNAME IMS Database name
79 (4F) CHARACTER 23 *
Part 2 - data item reference section
The data item reference section is in the first physical record of the audit record, immediately after the audit record header. It consists of 2 parts: the data item reference header, followed by the data item reference array. Audit record: Data item reference header shows the information contained in the data item reference header.
Table 2. Audit record: Data item reference header

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets Type Len Name (Dim) Description
Dec Hex
102 (66) UNSIGNED BINARY 2 LOG_ITEM_CNT Number of data items in the data section of the audit record.
104 (68) UNSIGNED BINARY 2 LOG_REC_COUNT Number of physical records required to write the audit log record. A value greater than 1 implies there are continuation records.
The data item reference array is an array of entries. Each entry describes a single data item. The LOG_ITEM_CNT value in the data item reference header (see Audit record: Data item reference header) specifies the number of elements in the array.
Audit record: Data item reference section shows the information contained in a data item reference array element.
Table 3. Audit record: Data item reference section

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) STRUCTURE 8 LOG_DATA_ITEM(*)
0 (0) UNSIGNED BINARY 2 LOG_ITEM_CODE Item data code. See Data items common to all audit records.
2 (2) CHARACTER 1 LOG_DATATYPE Data type code. See Data item types common to all audit records.
3 (3) CHARACTER 1 * Reserved/filler
4 (4) SIGNED BINARY 4 LOG_ITEM_DATLEN Fullword length
Part 3 - data section
The data section contains all of the data for the various data items defined in the data item reference section of the record. Each data item is stored in sequence and occupies exactly the length given in the data item reference section. There are no space bytes between data items.

The data items depend on the File Manager component and the record type. In general terms, each record type is associated with some data items that are always written, followed by some data items that are specific to the record type and the component that is in use.

Audit record: Data section shows the information contained in the data section:
Table 4. Audit record: Data section

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) STRUCTURE * LOG_DATAAREA
0 (0) UNSIGNED BINARY 2 LOG_DATALEN Length of LOG_DATA
2 (2) STRUCTURE * LOG_DATA logging data
Note: For continuation records, the data for the incomplete data item continues from the previous record, immediately after the continuation record header, as shown in Audit record: continued record.
Table 5. Audit record: continued record

This table has six columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) CHARACTER 102 LOG_HEADER_FIXED The Audit record header (see Audit record: Header)
102 (66) UNSIGNED BINARY 2 LOG_CONT_LEN Length of continued data
104 (68) CHARACTER * LOG_CONT_DATA The data for the incomplete data item (and possibly other data items)
Table 6. Data items common to all audit records

This table has three columns, except for the first header, where the heading "Offsets" spans two columns, with subheadings "Dec" and "Hex".

Data item Usage Usual length
4 Audit record type 1
3 File Manager component that wrote the record. A fixed field with the possible values:
0
File Manager Base component
1
FM/IMS component
2
FM/Db2 component
3
FM/CICS component
1
911 File Manager function code 8
92 File Manager internal function code. This will usually be the same as the File Manager function code. 8
Table 7. Data item types common to all audit records
Data item type code Data item type
B Binary
C Character (default)
U Unformatted
1 This data item is not included in any FM/IMS audit records except for the Template record (Audit record type T).