Audit header and audit section

Provides optional server user or end user audit information. When auditing information is supplied, there will be a server user section and optionally, an end user section. The SMF82AUD_HDR_NUM_SECTIONS field of the Auditing Header section indicates whether only a server user section is provided or if an end user section is also provided. If both a server user section and an end user section are present, they can appear in either order.

Table 1. SMF type 82 server user or end user audit section
Offsets Name Length Format Description
0 0 SMF82AUD_SECTION_TYPE 4 EBCDIC Type of the section that follows. Either:
  • ′SERV′ (for server user)
  • ′USER′ (for end user)
4 4 SMF82AUD_SECTION_NUM_FLDS 2 Binary Number of triples in this section
6 6 SMF82AUD_SECTION_TOTAL_LEN 2 Binary Overall length of this section, including this header
8 8 Tag-Length-Value (TLV) triplets start here and are defined in Table 2. These repeat as many times as the SMF82AUD_SECTION_NUM_FLDS field indicates.
Each Tag-Length-Value (TLV) triplet is a structure that is called SMF82AUD_TRIPLET and is defined as follows. The values for the tags and the format and maximum length of the data are defined in Table 3.
Table 2. Tag-Length-Value (TLV) triplet structure (SMF82AUD_TRIPLET)
Offsets Name Length Format Description
0 0 SMF82AUD_TRIPL_TAG 2 Binary Tag of the information in this TLV
2 2 SMF82AUD_TRIPL_LENGTH 2 Binary Length of this TLV including these first two fixed fields
4 4 SMF82AUD_TRIPL_DATA * Varies Data for this TLV

The tag values and their corresponding information are described in the following table. The tag value is defined in the constant SMF82AUD_TAG_xxx and the maximum length in SMF82AUD_MAXLEN_xxx. For example, the tag for X500_IDN is SMF82AUD_TAG_X500_IDN and maximum length of the associated data is SMF82AUD_MAXLEN_X500_IDN.

Table 3. TLV triplet tag values
Tag Value Name Length Format Description
1 1 X500_IDN 0-255 EBCDIC X.500 Certificate Issuer’s Distinguished Name (ACEEX5PR->IDN)
2 2 X500_SDN 0-255 EBCDIC X.500 Certificate Subject’s Distinguished Name (ACEEX5PR->SDN)
10 A IDID_USRI 1-246 UTF-8 X.500 Distinguished Name of distributed client end user (ACEEIDID-> IDID1UDN)
11 B IDID_USRF 1 Binary Format of IDID_USRI (ACEEIDID->IDID1NMF)
0
Undetermined
1
Straight string
2
X.500 format
12 C IDID_REG 1-255 UTF-8 Name of the registry that authenticated the user (ACEEIDID->IDID1RN)
14 E USRI 8 EBCDIC RACF user ID (ACEEUSRI)
15 F GRPN 8 EBCDIC Connect group (ACEEGRPN)
16 10 TRM_USER 8 EBCDIC Terminal ID (ACEETRM)
17 11 JOB_JBN 8 EBCDIC Job name (JMRJOB)
18 12 JOB_RST 4 Binary Job entry time (JMRENTRY) in hundredths of a second that the reader recognized the JOB statement for this job. This field can be zero.
26 1A JOB_RSD 4 Binary Job entry date (JMREDATE) that the reader recognized the JOB statement for this job in the form 0CYYDDDF. This field can be zero.
34 22 JOB_UID 8 Binary User-defined identification field (JMRUSEID)
42 2A SEC 8 EBCDIC Security label (TOKSCL)