search cancel

ACTION(AUDIT) On Top Secret Permit vs Adding To AUDIT Record

book

Article ID: 257671

calendar_today

Updated On:

Products

Top Secret

Issue/Introduction

What is the difference between ACTION(AUDIT) on a PERMIT and adding the resource to the AUDIT record?

Environment

Release : 16.0

Resolution

  • With ACTION(AUDIT) on a PERMIT, any time that permit is used to allow access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
  • With adding a resource to the AUDIT record, any time the resource is successfully accessed, regardless of what permit allowed access, an audit record (OK+A) will be cut to the audit file and/or SMF file.
  • For unsuccessful access attempts, a violation (08-xx) will be logged regardless of whether or not there is a permit with ACTION(AUDIT) or the resource is in the AUDIT record.