Logged Events - Audit Logging

This section lists the events that are logged for each of the SuperSTAR components, as well as what data is logged in each event record.

Common Data

All event records contain the following information:

Key	Description	Example
time	The time the event occurred (UNIX timestamp, in UTC). The accuracy of the timestamp information depends on the machine where the event logger is running.	1361592000
hostname	The name of the host machine that generated the event.	myhostname
source	The name of the source application that generated the event.	SuperWEB2
action	The action being logged. See the tables below for more details about the actions that are logged by each application.	login
user	The username of the user who generated the event.	johndoe
groups	The groups this user belongs to.	[ group1, group2 ]
thread	A thread ID.	42

Some event records include additional data, which is listed in the tables below.

SuperWEB2

Action Description Additional Data

login

A user has successfully logged in to SuperWEB2.

logout

A user has logged out of SuperWEB2.

login.failed

Unsuccessful login attempt. The user value shows the username that was used in the failed login attempt.

query

A tabulation query has completed successfully.

When this event is logged, full details of the table that was used in the query are recorded in TXD (Textual Table Definition) format. This is a proprietary text based format for describing the structure of a SuperSTAR table; it is one of the SuperCROSS save options and is the internal format used to save tables inside SuperWEB2. TXD files can be loaded into SuperCROSS, added to SuperWEB2 by an administrator, and used with the Production System.

txd	The TXD used in the query (up to 60,000 characters).
txdId	The unique ID for this TXD.

query.part

This is the same as query except it is used when the TXD is very large and needs to be split into multiple parts.

txd	Up to 60,000 characters of the TXD used in the query.
txdId	The unique ID for this TXD.
part	The part number. Each part of the query has a unique part number.

query.failed

A tabulation query was not successful.

txd	The TXD used in the query (up to 60,000 characters).
txdId	The unique ID for this TXD.

query.failed.part

This is the same as query.failed except it is used when the TXD is very large and needs to be split into multiple parts.

txd	Up to 60,000 characters of the TXD used in the query.
txdId	The unique ID for this TXD.
part	The part number. Each part of the query has a unique part number.

table.displayed

A table for a query has been displayed in SuperWEB2.

txdId	The unique ID for this TXD. You can use this identify the related query record in the logs.

chart.displayed

A chart for a query has been displayed in SuperWEB2.

txdId	The unique ID for this TXD. You can use this identify the related query record in the logs.

map.displayed

A map for a query has been displayed in SuperWEB2.

txdId	The unique ID for this TXD. You can use this identify the related query record in the logs.

unitdata.displayed

Unit record data (RecordVIEW) has been displayed in SuperWEB2.

selectedColumns	A list of the columns selected when displaying unit record data.

SuperADMIN

Action

Description

Additional Data

admin.login

An administrator has logged into SuperADMIN.

admin.logout

An administrator has logged out of SuperADMIN.

admin.operation.failed

An administrator operation failed.

operation	The action that was attempted.
command	The command issued by the user.
message	A reason for the failure.

group.created

A group has been created.

groupid	The group ID.
displayname	The display name of the group.

group.removed

A group has been removed

groupid	The group ID.

group.displayname.changed

The display name for a group has been changed.

groupid	The group ID.
to	The new display name of the group.

user.created

A user has been created.

userid	The user ID of the new user.
displayname	The user's display name.

user.removed

A user has been removed.

userid	The user ID of the deleted user.

user.added.to.group

A user has been added to a group.

userid	The user ID.
groupid	The ID of the group this user has been added to.

user.removed.from.group

A user has been remove from a group.

userid	The user ID.
groupid	The ID of the group this user has been removed from.

user.displayname.changed

A user's display name has been changed.

userid	The user ID.
to	The new display name for this user.

user.locked

A user account has been locked.

userid	The user ID.

user.unlocked

A user account has been unlocked.

userid	The user ID.

database.added

A database has been added to the catalogue.

databaseid	The database ID.
displayname	The database's display name.
path	The location of the database's SXV4 file.

database.removed

A database has been removed from the catalogue.

databaseid	The database ID.

database.location.changed

The location of a database's SXV4 file has been changed.

databaseid	The database ID.
path	The new location of the database's SXV4 file.

database.displayname.changed

The display name of a database has been changed.

databaseid	The database ID.
to	The new display name for this database.

database.access.granted.to.user

A user has been granted access to a database.

databaseid	The database ID.
userid	The user ID.

database.access.revoked.from.user

A user's access to a database has been revoked.

databaseid	The database ID.
userid	The user ID.

database.access.granted.to.group

A group has been granted access to a database.

databaseid	The database ID.
groupid	The group ID.

database.access.revoked.from.group

A group's access to a database has been revoked.

databaseid	The database ID.
groupid	The group ID.

SuperSERVER

Action

Description

Additional Data

tabulation.request

A cross tabulation job has been submitted to the server.

jobid	The job ID for the query.

tabulation.started

SuperSERVER has started processing a cross tabulation job.

jobid	The job ID for the query.
duration	The time taken to complete the action (in milliseconds).

tabulation.complete

A cross tabulation job has completed successfully. The event record includes the job ID and the time taken to complete the tabulation (in seconds).

jobid	The job ID for the query.
duration	The time taken to complete the action (in milliseconds).

tabulation.retrieved

The cross tabulation results have been retrieved by the client.

jobid	The job ID for the query.
duration	The time taken to complete the action (in milliseconds).