ACTION(AUDIT) On Top Secret Permit vs Adding To AUDIT Record

Products

• Top Secret

Issue/Introduction

What is the difference between ACTION(AUDIT) on a PERMIT and adding the resource to the AUDIT record?

Environment

Release : 16.0

Resolution

• With ACTION(AUDIT) on a PERMIT, any time that permit is used to allow access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
• With adding a resource to the AUDIT record, any time the resource is successfully accessed, regardless of what permit allowed access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
• For unsuccessful access attempts, a violation (08-xx) will be logged regardless of whether or not there is a permit with ACTION(AUDIT) or the resource is in the AUDIT record.