ACTION(AUDIT) On Top Secret Permit vs Adding To AUDIT Record
book
Article ID: 257671
calendar_today
Updated On:
Products
Top Secret
Issue/Introduction
What is the difference between ACTION(AUDIT) on a PERMIT and adding the resource to the AUDIT record?
Environment
Release : 16.0
Resolution
With ACTION(AUDIT) on a PERMIT, any time that permit is used to allow access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
With adding a resource to the AUDIT record, any time the resource is successfully accessed, regardless of what permit allowed access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
For unsuccessful access attempts, a violation (08-xx) will be logged regardless of whether or not there is a permit with ACTION(AUDIT) or the resource is in the AUDIT record.