nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

dm_audittrail_acl question

Roman_N

Hello

i am using dm_audittrail_acl to view changes made in dm_acl objects

but when extended permissions are changed the output of repeating attributes becomes chaotic

select event_name,
string_1,
accessor_operation,
accessor_name,
accessor_permit ,
accessor_xpermit,
permit_type ,
is_group,
datetostring(time_stamp, 'dd.mm.yyyy hh:mi:ss') as time_stamp,
object_name,
user_name,
event_description
from dm_audittrail_acl

dm_save    Save    D    testuser1    3    2    1    0    14.05.2009 15:54:19    testacl2    Admin    Save Object
dm_save    Save    U    testuser1    0    524291    1    0    14.05.2009 15:54:19    testacl2    Admin    Save Object
dm_save    Save    U    testuser1    3    524290    0    0    14.05.2009 15:54:19    testacl2    Admin    Save Object
dm_save    Save    D    testuser1    3    524290    1    0    14.05.2009 15:54:19    testacl2    Admin    Save Object

I change testacl2 for testuser1: he has extended rights "Execute Procedure" and "Extended Delete", i removed "Execute Procedure"

Why I get 4 rows of changes?

ps cs5.3sp6

Find more posts tagged with

Comments

mszurap

Hi,

What if you query r_object_id in your query? We should then see how many operations was it in the background.

Roman_N

r_object_id

event_name

string_1

accessor_operation

accessor_name

accessor_permit

accessor_xpermit

permit_type

is_group

time_stamp

object_name

user_name

event_description

5f0000038001bedf

dm_save

Save

U
D
D
U

testuser1
testuser1
testuser1
testuser1

0
3
3
3

524291
2
524290
524290

1
1
1
0

0
0
0
0

14.05.2009 15:54:19

testacl2

Admin

Save Object

Of course i selected attributes from one trail record

khwajs

Have you used DA or IAPI to revoke the extended permission?

What was the basic permission during revoke?

Roman_N

i used DA

basic permission is in accessor_permit = 3 (Read)

venkas6

Hi,

How are you auditing the acl objects? Are you auditing for a particular object or type level auditing for dm_acl?

I guess you are in 5.3sp6 CS. I don't see this behaviour as you explained.

I see only one entry in dm_audittrail_acl object for the change in extended permissions for a particular acl.

What are the exact operations that you do when you see this inconsistency. As per the operation that you mentioned, I don't see more than expected entries in dm_audittrail_acl.

Thanks,

Sekhar

khwajs

Can you provide the below information to understand the auditing?

Dump of ACL object before revoke operation.
Enable the DMCL trace and do the revoke. DMCL trace for ACL object will help us to understand the API called for this revoke operation.

Please verify that you are getting the four audit trail record for above operation.

Roman_N

Audit by dm_acl type

Events: dm_save,dm_destroy,dm_saveasnew

I created testacl and added testuser1 with default permissions - Read and extended - Change Location, Run Procedure

select r_object_id, object_name, r_accessor_name, r_accessor_permit, r_accessor_xpermit 
from dm_acl where object_name = 'testacl'

r_object_id	object_name	r_accessor_name	r_accessor_permit	r_accessor_xpermit
450000038000f542	testacl	dm_owner dm_world testuser1	7 3 3	0 0 0

Then i revoke Change Location permission via DA

Here is the log for these two operations:

select 
r_object_id, event_name,
string_1,accessor_operation,
accessor_name,accessor_permit ,
accessor_xpermit,permit_type ,
is_group,time_stamp,
object_name,user_name,event_description
from dm_audittrail_acl order by time_stamp desc

r_object_id

event_name

string_1

accessor_operation

accessor_name

accessor_permit

accessor_xpermit

permit_type

is_group

time_stamp

object_name

user_name

event_description

5f000003800207e6

dm_save

Save

U
D
D
U

testuser1
testuser1
testuser1
testuser1

0
3
3
3

2
2
0
0

1
1
1
0

0
0
0
0

18.05.2009 14:53:21

testacl

Admin

Save Object

5f000003800207d0

dm_save

Create

U
D
I
I
I
D
U

testuser1
testuser1
testuser1
dm_owner
dm_world
testuser1
testuser1

0
3
3
7
3
3
0

1
0
0
0
0
2
0

1
1
0
0
0
1
1

0
0
0
0
0
0
0

18.05.2009 14:47:53

testacl

Admin

Save Object

khwajs

Have you uploaded the DMCL trace for your operation?

What is the DA version?

Roman_N

DA is 5.3sp4

Here is logfile for new dm_acl object 450000038000fd00 (testacl)

khwajs

Below is the DMCL call from the DA, which is causing the extra auditing rows.

During ACL create:

# [ 4332 ] Wed May 20 10:09:11 2009 281000 ( 0.000 sec) ( 405 rpc) API> grant,s0,450000038000fd00,'testuser1',AccessPermit,,3