3.11 System monitoring using audit logs

An audit log is a file containing historical information about the operations performed on OpenTP1 programs by system developers, operators, and users, together with the program behavior triggered by those operations. By examining an audit log, the auditor can find out what was done, when, and by whom. Thus, audit logs can be used as records for investigating system usage and unauthorized access.

The entries in an audit log include information about the user who executed a command or performed an operation, information about audited events such as whether the processing resulting from an operation succeeded or failed, and information about the object of an operation or process. This information is useful for monitoring the system.

When OpenTP1 is linked with JP1/NETM/Audit, audit logs can be automatically collected and centrally managed.

Figure 3-78 shows the flow of audit logging and the main types of information acquired.

Figure 3-78 Audit logging and main categories of information acquired

[Figure]

Information is output to an audit log when an operation is performed in an OpenTP1 program, such as execution of a command. Logged operations may be executed by a system administrator or operator, according to the task being performed. An entry is also logged when an audited event occurs in a process. Audited events are OpenTP1 program operations and resultant processing that need to be recorded to examine the adequacy of the system configuration, operation, and usage. Audited events are categorized and defined in OpenTP1 as shown in Table 3-21.

Table 3-21 Definition of audited events

Event categoryEvent descriptionOutput information
StartStopEvent indicating that software was started or stopped
  • OpenTP1 started or stopped
  • User server startup or termination
StartSoftware started
StopSoftware stopped
AuthenticationEvent indicating whether attempted authentication by a client user succeeded or failedLoginUser logged in
LogoutUser logged out
LogonUser logged on
LogoffUser logged off
DisableAccount disabled
AccessControlEvent indicating whether attempted access by an administrator or user to a controlled resource succeeded or failedEnforceAccess controlled
ConfigurationAccessEvent indicating whether an operation by an administrator or user to change or otherwise manipulate setting information succeeded or failedReferInformation referenced
AddInformation added
UpdateInformation updated
DeleteInformation deleted
FailureEvent indicating a software errorOccurError occurred
LinkStatusEvent indicating whether equipment is linkedUpLink active
DownLink inactive
ExternalServiceEvent indicating the result of communication between the software and an external serviceRequestRequest
ResponseResponse
SendSend
ReceiveReceive
ContentAccessEvent indicating whether attempted access to critical data succeeded or failedReferInformation referenced
AddInformation added
UpdateInformation updated
DeleteInformation deleted
MaintenanceEvent indicating whether a maintenance operation by an administrator or technician succeeded or failedInstallSoftware installed
UninstallSoftware uninstalled
UpdateSoftware updated
BackupData backup
MaintainMaintenance task
AnomalyEventEvent indicating a communication errorOccurError occurred
ManagementActionEvent indicating a critical action in a program, or an action triggered by a different category of audited eventInvokeAdministrator called a function
NotifyAdministrator was notified

Events are defined for each audit event category. For a detailed list of audit events, see the description of logged event information in the manual OpenTP1 Operation.

OpenTP1 provides an API (dc_log_audit_print function) that outputs specified audit log data from a UAP. Using this API, you can output audit log entries when a UAP operation is performed or processing is performed by the UAP, as well as when an audit event occurs.

For details about logging selected audit information, see the OpenTP1 Programming Guide.