IBM Tivoli Monitoring, Version 6.3

Audit log XML elements mapped to the ITM Audit attribute group

The audit log XML contains elements that coordinate to ITM Audit attributes.

For detailed XML syntax information, see the SAPMAudit.dtd on the IBM® Tivoli® Monitoring Tools DVD.

For descriptions of the attributes see the ITM Audit attributes.

Use the following table for your reference:

Note:

Some cells are intentionally blank to represent the audit log XML structure. Empty ITM Audit attribute cells indicate that a coordinating attribute has not been created yet for the coordinating XML element.
XML elements and XML attributes in parenthesis ( ) indicate that the item is not implemented by IBM Tivoli Monitoring.
*Extra Attributes means the XML element or attribute is inserted as a Name=Value pair in the Extra Attribute column in the Audit Log table.

Logical group	XML element(s)		XML attribute	ITM Audit attribute
AuditEvt	AuditEvt		Domain	Domain
			Level	Trace Level
			Type	Event Record Type
			Ver	Audit Record Version
Who	AuthID			Authorization ID
	AuthID		(Repository)
	RunAs			RunAs
	RunAs		(Repository)
	UserID			User ID
	UserID		(Repository)
	Entity			Entity
	Entity		Type	Entity Type
What	Op		(CDMID)
			Name	Operation Name
			Type	Operation Type
			OpObjType	Operation Object Type
	Msg		Text	Message
	Msg		RBKey	Resource Bundle Key
	Param			Extra Attributes*
	Param		Order	Extra Attributes*
	Result			Result
When	Corr			Correlator
	Seq			Sequence
	EvtTS		MS	Timestamp (MS)
			ITM	Timestamp
			(UTC)
	(LogTS)
OnWhat	Obj		Type	Object Type
			(Ver)	Object Version
			Name	Object Name
			(CDMID)	Extra Attributes*
			Path	Object Path
	(SecMaint)	Grantee	Type
		SecPolicy
		Constraint
	(SecPolicy)			Security Policy Name
	(Grantee)			Grantee
	(Grantee)		Type	Grantee Type
	(PriAuthEvt)			Privilege Or Authority Event
			Type	Privilege Or Authority Type
			AuthID	Assumable Auth ID
			Repository
	(AuthVal)
	(AuthCheck)			Extra Attributes*
	(AuthPlugin)		Type	Authorization Plugin Type
	(AuthPlugin)		Server	Extra Attributes*
Where	Origin	Node	Name	Origin Name
			Type	Origin Type
			AddrType	Origin Protocol
			Addr	Origin Address
			Host	Origin Hostname
			Port	Origin Port
			SYSID	Origin
	App		Code	Application Code
			Ver	Application Version
			Comp	Application Component
	SvcPt			Service Point
WhereFrom	Source	Node	Name	Source Name
			Type	Source Type
			AddrType	Source Protocol
			Addr	Source Address
			Host	Source Hostname
			Port	Source Port
			SYSID	Source
	Relay	Node	Name
			Type
			AddrType
			Addr
			Host
			Port
			SYSID
WhereTo	Target	Node	Name	Target Name
			Type	Target Type
			AddrType	Target Protocol
			Addr	Target Address
			Host	Target Hostname
			Port	Target Port
			SYSID	Target