Event Source |
Event Type and Event |
Occurs When |
Event Data Contents |
Default Status |
%Ensemble |
%Message/
ViewContents |
A user views the contents of a message in the Message Viewer. |
Metadata about the message. |
On |
%Ensemble |
%Production/
ModifyConfiguration |
A user modifies the configuration of a production. |
A summary of the change. |
On |
%Ensemble |
%Production/
StartStop |
A user starts or stops a production. |
Action (start or stop) and the username for the initiator of the action. |
On |
%Ensemble |
%Schema/
Modify |
A user creates, modifies, or deletes a schema structure. |
A summary of the change. |
On |
%System |
%DirectMode/
DirectMode |
Any command is executed in direct mode. |
The text of command. |
Off |
%System |
%Login/
JobEnd |
The JOB command ends a background job. |
The routine where the Job command was executed and the database where the routine is stored. If the values for these fields are null, then the Job command was executed from the shell. |
Off |
%System |
%Login/
JobStart |
The JOB command starts a background job. |
The routine where the Job command was executed and the database where the routine is stored. If the values for these fields are null, then the Job command was executed from the shell. |
Off |
%System |
%Login/
Login |
A user successfully logs in. |
The protocol, port number, process ID, and application associated with the login. The user’s login roles. |
Off |
%System |
%Login/
LoginFailure |
A login attempt fails. |
Username. |
Varies* |
%System |
%Login/
Logout |
A user logs out. |
The application (and, if relevant, the class) associated with the logout. |
Off |
%System |
%Login/
TaskEnd |
The Task Manager ends a process. |
None. See the Description for the name of the task. |
Off |
%System |
%Login/
TaskStart |
The Task Manager starts a process. |
None. See the Description for the name of the task. |
Off |
%System |
%Login/
Terminate |
A process terminates abnormally. |
Varies, as does the Description field’s content; see below. |
Off |
%System |
%SMPExplorer/
Change |
Data is altered using the Portal, such as by creating, editing, deleting, compiling, dropping, replacing, or purging classes or tables. |
Varies, as does the Description field, depending on the action taken. Includes relevant content such as the compile flags or the schema and table being dropped. |
Off |
%System |
%SMPExplorer/
ExecuteQuery |
A query is executed using on the Portal’s SQL page. |
The syntax of the executed query. |
Off |
%System |
%SMPExplorer/
Export |
Data is exported through the Portal. |
The options selected for data export. |
Off |
%System |
%SMPExplorer/
Import |
Data is imported through the Portal. |
The options selected for data import. |
Off |
%System |
%SMPExplorer/
ViewContents |
Data is viewed through the Portal. |
The filters that determined what data was viewed. The Description field specifies what was viewed, such as a list of classes, an individual global, or process information. |
Off |
%System |
%SQL/
DynamicStatement |
A dynamic SQL call is executed. |
The statement text and the values of any host-variable arguments passed to it. If the total length of the statement and its parameters exceeds 3,632,952 characters, the event data is truncated. |
Off |
%System |
%SQL/
EmbeddedStatement |
An embedded SQL call is executed. See below for usage details. |
The statement text and the values of any host-variable arguments passed to it. If the total length of the statement and its parameters exceeds 3,632,952 characters, the event data is truncated. |
Off |
%System |
%SQL/
PrivilegeFailure |
There is an SQLCODE=-99 error, which occurs because a user attempts to execute an SQL statement without the required privilege. |
-
The SQL error message
-
The required privilege that the user doesn’t have
-
The entity type where the privilege is missing, such as table, view, stored procedure
-
The table, view, or other entity on which the user lacks privileges
-
If there are column-level privileges, the relevant fields
|
Off |
%System |
%SQL/
XDBCStatement |
A remote SQL call is executed using ODBC or JDBC. |
The statement text and the values of any host-variable arguments passed to it. If the total length of the statement and its parameters exceeds 3,632,952 characters, the event data is truncated. |
Off |
%System |
%Security/
ApplicationChange |
An application definition is created, changed, or deleted. |
Action (create new, modify, or delete), old and new application data. |
On |
%System |
%Security/
AuditChange |
Auditing is stopped or started, entries are erased or deleted, or the list of events being audited is changed. |
Action (stop, start, erase, delete, or specify), old and new audit settings. |
On |
%System |
%Security/
AuditReport |
Any standard audit report is run. |
Identification of audit report. |
On |
%System |
%Security/
DBEncChange |
There is a change related to database or data-element encryption. |
Varies, as does the Description field’s content. See below. |
On |
%System |
%Security/
DocDBChange |
A document database application definition is created, changed, or deleted. |
A summary of the change and a list of the current values, if applicable. |
On |
%System |
%Security/
DomainChange |
A domain definition is created, changed, or deleted. |
Action (new, modify, delete), old and new domain data. |
On |
%System |
%Security/
KMIPServerChange |
A KMIP server definition is created, changed, or deleted, or KMIP servers are exported or imported. |
A summary of the action and a list of the current values, if applicable. See the Description for additional details. |
On |
%System |
%Security/
LDAPConfigChange |
An LDAP configuration is created, changed, or deleted. |
A summary of the change and a list of the current values, if applicable. |
On |
%System |
%Security/
OpenAMIdentityServicesChange |
OpenAM Identity Services records are exported or imported. |
File name and the number of records exported to or imported from the file. |
On |
%System |
%Security/
PhoneProvidersChange |
A mobile phone service provider is created, updated, or deleted. |
For creating a provider, its name and the value of its SMS gateway
For updating a provider, its name, and the old and new values of its SMS gateway.
For deleting a provider, there is no event data; the name of the deleted provider is in the event description |
On |
%System |
%Security/
Protect |
A process generates a security protection error. |
The error. |
Off |
%System |
%Security/
ResourceChange |
A resource definition is created, changed, or deleted. |
Action (new, modify, or delete), old and new resource data. |
On |
%System |
%Security/
RoleChange |
A role definition is created, changed, or deleted. |
Action (create new, modify, or delete), old and new role data. |
On |
%System |
%Security/
SSLConfigChange |
A TLS configuration’s settings are changed. |
The changed fields with old and new values. |
On |
%System |
%Security/
ServiceChange |
A service’s security settings are changed. |
Old and new service security settings. |
On |
%System |
%Security/
SystemChange |
System security settings are changed. |
Old and new security settings. |
On |
%System |
%Security/
UserChange |
A user definition is created, changed, or deleted. |
Action (create new, modify, or delete), old and new user data. |
On |
%System |
%Security/
X509CredentialsChange |
A user creates, updates, or deletes a set of X.509 credentials. |
Varies by event. See below |
On |
%System |
%Security/
X509UserChange |
Event defined, but not available for auditing until a future release. |
N/A |
On |
%System |
%System/
AuditRecordLost |
An audit entry has not been added to the audit database due to resource limitations that constrain the audit system (such as disk or database full). |
None. |
On |
%System |
%System/
ConfigurationChange |
InterSystems IRIS successfully starts with a configuration different than the previous start, a new configuration is activated while InterSystems IRIS is running, or a lock is deleted through the Portal or through the ^LOCKTAB utility. |
Username for the user who made the change; previous and new values of the changed element. For deleted locks, information about which lock was deleted. |
On |
%System |
%System/
DatabaseChange |
There are changes to database properties. See below. |
Details about the particular change. See below. |
On |
%System |
%System/
JournalChange |
Journaling is started or stopped for a database or process. |
When journaling is started, the name of the database and its maximum size; when journaling is stopped, none. |
On |
%System |
%System/
OSCommand |
An operating-system command is issued from within the system, such as through a call to the $ZF(-100) function. |
The operating system command that was invoked; the directory in which it was invoked; and any flags associated with the command. |
On |
%System |
%System/
RoutineChange |
A method or routine is compiled or deleted on the local instance. For more details, see below. |
No content, though the Description field depends on the change itself; see below. |
Off |
%System |
%System/
Start |
The system starts. |
Indication of whether recovery was performed. |
On |
%System |
%System/
Stop |
InterSystems IRIS is shut down. |
None. |
On |
%System |
%System/
SuspendResume |
A process is suspended or resumed. |
The process ID of the process. |
Off |
%System |
%System/
UserEventOverflow |
An application attempts to log an undefined event. |
The name of the event that the application attempted to log. |
On |