ACTION(AUDIT) On Top Secret Permit vs Adding To AUDIT Record
Article ID: 257671
What is the difference between ACTION(AUDIT) on a PERMIT and adding the resource to the AUDIT record?
Release : 16.0
With ACTION(AUDIT) on a PERMIT, any time that permit is used to allow access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
With adding a resource to the AUDIT record, any time the resource is successfully accessed, regardless of what permit allowed access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
For unsuccessful access attempts, a violation (08-xx) will be logged regardless of whether or not there is a permit with ACTION(AUDIT) or the resource is in the AUDIT record.