| |
In addition to processing online audit files, AUDITCON also allows you to process offline audit files. These offline files can be stored on the auditor's workstation, removable media, or even in the auditor's directory on the server file system.
Files stored in the server file system are considered offline, even if they contain audit data, because the server does not directly manage these files as audit files.
Offline audit files are in the same null-compressed, binary format as the server's audit files described in Audit File Formats.
This section describes how to process and protect these offline audit files.
NOTE: AUDITCON controls access to the offline audit file based on the current contents of the Audit File object for that file. Note that your rights to the Audit File object might be different from your rights when the offline audit file was recorded, so, for example, you might not be able to read an offline audit file that you recorded. Note also that this is a constraint imposed by AUDITCON, and not a server access control mechanism. Offline audit files must be protected by the client TCB or (for removable media) by physical protection.
Choose Reports from old offline file from the Available audit options menu (2101).
AUDITCON prompts you for the name of an offline audit file.
For DOS workstations, the file name can be an absolute DOS pathname (for example, F:\AUDIT\95FEB15.DAT) or a relative pathname in your current directory (for example, AUDIT.DAT).
Enter the pathname for the offline audit file.
Press Enter to open the audit file, or Esc to return to menu 2600.
If AUDITCON cannot open the file, it displays an error message.
If AUDITCON can open the file, it displays menu 2602, which permits you to select more operations on the offline audit file.
Figure 122
Menu 2602: Reports from Old Offline File
Choose the desired operation, then press Enter to perform that operation.
This section describes how you can generate a text report of the audit history information in an offline audit file.
Choose Report audit history from the Reports from old offline files menu (2602).
AUDITCON displays menu 2530, which lists more configuration options.
Follow the procedures in Report Audit History to generate a text audit history report for an offline audit file.
Interpret references to the current audit file as references to an offline audit file.
This section describes how you can generate a binary version of the external audit records in an offline audit file. Use a client-specific utility to convert the binary audit records into a text form.
Choose Dump external binary to file from the Reports from old offline files menu (2602).
AUDITCON displays menu 2540, which lists more configuration options.
Follow the procedures in Generating External Audit Trail Reports to generate a text audit history report for an offline audit file.
Interpret references to the current audit file as references to an offline audit file.
This section describes how you can view (on your workstation screen) the audit history for an offline audit file.
Choose View audit history from the Reports from old offline files menu (2602).
AUDITCON displays menu 2570.
Follow the procedures in View Audit History to view the audit history for an offline audit file.
Interpret references to the current audit file as references to an offline audit file.
This section describes how you can generate a report of the audit history information in an offline audit file in a form suitable for loading into a database.
Choose Database report audit history from the Reports from old offline files menu (2602).
AUDITCON displays menu 2810.
Follow the procedures in Database Report Audit History to generate a text audit history report for an offline audit file.
Interpret references to the current audit file as references to an offline audit file.
| |