Z Data Tools audit records

This section describes the structure of, and information recorded in, Z Data Tools audit records.

An audit log record may occupy one or more physical records in the audit file. When an audit log record requires two or more physical records, the second and subsequent log records are continuation records.

Each Z Data Tools audit record consists of three parts:
  • Record header
  • Data item reference section
  • Data section
Part 1 - record header
Table 1 shows the information contained in the record header. The record header is at the start of each physical record that makes up the audit log record.
Table 1. Audit record: Header
Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) BIT(8) 1 LOG_FLAGS Log flags
    1... .... LOG_CONT Continuation indicator
    .1.. .... LOG_IMS Log record for ZDT/IMS
    ..1. .... LOG_DB2 Log record for ZDT/Db2
    ...1 .... LOG_CICS Log record for ZDT/CICS
    .... 111. *  
    .... ...1 LOG_V2IND Log record Version 2 or later
1 (1) UNSIGNED BINARY 1 LOG_VERSION Version number
           
2 (2) UNSIGNED BINARY 4 LOG_RECNUM Record count within the current audit session
6 (6) CHARACTER 5 LOG_ID Log record constant

'FMIMS' (IMS™ eyecatcher)
'FMDB2' (Db2® eyecatcher)
'FMCIC' (CICS® eyecatcher)
'FMLOG' (base eyecatcher)

11 (B) CHARACTER 3 *  
14 (E) UNSIGNED PACKED DECIMAL 4 LOG_DATE Date - yyyymmdd
18 (12) UNSIGNED PACKED DECIMAL 4 LOG_TIME Time - hhmmssth
22 (16) CHARACTER 8 LOG_SYSID MVS™ system ID (CVTSNAME)
30 (1E) CHARACTER 8 LOG_USERID Userid
38 (26) CHARACTER 8 LOG_SSID ZDT/Db2 System ID, IMS Subsystem name, or CICS Applid
46 (2E) CHARACTER 8 LOG_JOBNAME Job Name
54 (36) CHARACTER 8 LOG_JOBID Job ID
62 (3E) CHARACTER 1 LOG_SESSID Session ID
63 (3F) CHARACTER 8 LOG_FUNCOD Z Data Tools function code
71 (47) CHARACTER 8 LOG_DBNAME IMS Database name
79 (4F) CHARACTER 23 *  
Part 2 - data item reference section
The data item reference section is in the first physical record of the audit record, immediately after the audit record header. It consists of 2 parts: the data item reference header, followed by the data item reference array. Table 2 shows the information contained in the data item reference header.
Table 2. Audit record: Data item reference header
Offsets Type Len Name (Dim) Description
Dec Hex
102 (66) UNSIGNED BINARY 2 LOG_ITEM_CNT Number of data items in the data section of the audit record.
104 (68) UNSIGNED BINARY 2 LOG_REC_COUNT Number of physical records required to write the audit log record. A value greater than 1 implies there are continuation records.

The data item reference array is an array of entries. Each entry describes a single data item. The LOG_ITEM_CNT value in the data item reference header (see Table 2) specifies the number of elements in the array.

Table 3 shows the information contained in a data item reference array element.

Table 3. Audit record: Data item reference section
Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) STRUCTURE 8 LOG_DATA_ITEM(*)  
0 (0) UNSIGNED BINARY 2 LOG_ITEM_CODE Item data code. See Table 6.
2 (2) CHARACTER 1 LOG_DATATYPE Data type code. See Table 7.
3 (3) CHARACTER 1 * Reserved/filler
4 (4) SIGNED BINARY 4 LOG_ITEM_DATLEN Fullword length
Part 3 - data section
The data section contains all of the data for the various data items defined in the data item reference section of the record. Each data item is stored in sequence and occupies exactly the length given in the data item reference section. There are no space bytes between data items.

The data items depend on the Z Data Tools component and the record type. In general terms, each record type is associated with some data items that are always written, followed by some data items that are specific to the record type and the component that is in use.

Table 4 shows the information contained in the data section:

Table 4. Audit record: Data section
Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) STRUCTURE * LOG_DATAAREA  
0 (0) UNSIGNED BINARY 2 LOG_DATALEN Length of LOG_DATA
2 (2) STRUCTURE * LOG_DATA logging data
Note: For continuation records, the data for the incomplete data item continues from the previous record, immediately after the continuation record header, as shown in Table 5.
Table 5. Audit record: continued record
Offsets Type Len Name (Dim) Description
Dec Hex
0 (0) CHARACTER 102 LOG_HEADER_FIXED The Audit record header (see Table 1)
102 (66) UNSIGNED BINARY 2 LOG_CONT_LEN Length of continued data
104 (68) CHARACTER * LOG_CONT_DATA The data for the incomplete data item (and possibly other data items)
Table 6. Data items common to all audit records
Data item Usage Usual length
4 Audit record type 1
3 Z Data Tools component that wrote the record. A fixed field with the possible values:
0
Base component
1
ZDT/IMS component
2
ZDT/Db2 component
3
ZDT/CICS component
1
911 Z Data Tools function code 8
92 Z Data Tools internal function code. This will usually be the same as the Z Data Tools function code. 8
Note:
  1. This data item is not included in any ZDT/IMS audit records except for the Template record (Audit record type T).
Table 7. Data item types common to all audit records
Data item type code Data item type
B Binary
C Character (default)
U Unformatted