File and Message Format
•Do not have delimiters (no commas or spaces) between attributes
•Terminated by a carriage return and line feed (<CR><LF>)
Each element includes: an attribute code, data type, and value. It takes the format:
[ATTR(type):value][ATTR(type):value]...
[ATTR(type):value]<CR><LF>
Where:
•ATTR is a
•type is a
•value is the content of the attribute, typically a numeric or text value (text values are enclosed in single quotes). Values always follow a colon “:”.
The number of attribute elements in the message depends on the event type of the message.
Sample Audit Message
[HSID(UI64):811028912][DIDR(CSTR):’INBO’][HSCR(FC32):’SUCS’]
[AVER(UI32):2][ATYP(FC32):’HTSC’][ATIM(UI64):1099615457414746]
[ATID(UI64):11174705928149966150][ANID(UI32):12130010]
[AMID(FC32):’HTSM’][ASQN(UI32):49984]
Data Types
The data types encountered in the audit messages are:
Table 1: Data Types
Type | Description |
|
|
UI32 | Unsigned long integer (32 bits); it can store the numbers |
| |
|
|
UI64 | Unsigned double long integer (64 bits); it can store the |
| numbers |
|
|
FC32 | Four Character Constant; a |
| represented as four ASCII characters such as: “ABCD”. |
|
|
7
HP Medical Archive