Home > Class Reference > %SYS namespace > Security.Events

Security.Events

persistent class Security.Events extends %Library.Persistent, %XML.Adaptor, %SYSTEM.Help

SQL Table Name: Security.Events

This class defines the Audit Events for the system.

An Event name consists of 3 separate fields:

1) Source - Source of the event
2) Type - Type of the event
3) Event - Name of the event

And Event name is the combination of the 3 fields separated by "/". For example:

%System/%Login/Login

Event names have the following properties:
1) Source, Type, and Event fields are case insensitive.
2) Source, Type, and Event fields cannot contain a "/".
3) Only system defined events can have a Source = "%System" or Source start with a "%".
4) Only system defined events can have a Type start with a "%".


The table for this class should be manipulated only through object access, the published API's or through the System Management Portal. It should not be updated through direct SQL access.

Property Inventory

Method Inventory

Properties

property Description as %String (MAXLEN = 256);
Description of the event.
Property methods: DescriptionDisplayToLogical(), DescriptionGet(), DescriptionGetStored(), DescriptionIsValid(), DescriptionLogicalToDisplay(), DescriptionLogicalToOdbc(), DescriptionNormalize(), DescriptionSet()
property Enabled as Security.Datatype.BooleanYN [ InitialExpression = 0 , Required ];
Event enabled.
Property methods: EnabledDisplayToLogical(), EnabledGet(), EnabledGetStored(), EnabledIsValid(), EnabledLogicalToDisplay(), EnabledLogicalToODBC(), EnabledLogicalToXSD(), EnabledNormalize(), EnabledSet(), EnabledXSDToLogical()
property Name as %String (MAXLEN = 64, MINLEN = 1);
Name of the event.
Property methods: NameDisplayToLogical(), NameGet(), NameGetStored(), NameIsValid(), NameLogicalToDisplay(), NameLogicalToOdbc(), NameLowerCaseDisplayToLogical(), NameLowerCaseGet(), NameLowerCaseGetStored(), NameLowerCaseIsValid(), NameLowerCaseLogicalToDisplay(), NameLowerCaseLogicalToOdbc(), NameLowerCaseNormalize(), NameNormalize(), NameSet(), NameToDescription()
property Source as %String (MAXLEN = 64, MINLEN = 1);
Source (system events all have "%System" here).
Property methods: SourceDisplayToLogical(), SourceGet(), SourceGetStored(), SourceIsValid(), SourceLogicalToDisplay(), SourceLogicalToOdbc(), SourceLowerCaseDisplayToLogical(), SourceLowerCaseGet(), SourceLowerCaseGetStored(), SourceLowerCaseIsValid(), SourceLowerCaseLogicalToDisplay(), SourceLowerCaseLogicalToOdbc(), SourceLowerCaseNormalize(), SourceNormalize(), SourceSet(), SourceTypeNameLowerCaseIndexCheck(), SourceTypeNameLowerCaseIndexDelete(), SourceTypeNameLowerCaseIndexExists(), SourceTypeNameLowerCaseIndexOpen(), SourceTypeNameLowerCaseIndexSQLCheckUnique(), SourceTypeNameLowerCaseIndexSQLExists(), SourceTypeNameLowerCaseIndexSQLFindPKeyByConstraint(), SourceTypeNameLowerCaseIndexSQLFindRowIDByConstraint()
property Type as %String (MAXLEN = 64, MINLEN = 1);
Type.
Property methods: TypeDisplayToLogical(), TypeGet(), TypeGetStored(), TypeIsValid(), TypeLogicalToDisplay(), TypeLogicalToOdbc(), TypeLowerCaseDisplayToLogical(), TypeLowerCaseGet(), TypeLowerCaseGetStored(), TypeLowerCaseIsValid(), TypeLowerCaseLogicalToDisplay(), TypeLowerCaseLogicalToOdbc(), TypeLowerCaseNormalize(), TypeNormalize(), TypeSet()

Methods

classmethod Clear(EventSources As %String = "*", EventTypes As %String = "*", EventNames As %String = "*") as %Status [ Language = objectscript ]
Clear the in memory event counters for the specified events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
classmethod Create(Source As %String, Type As %String, Name As %String, Description As %String = "", Enabled As Security.Datatype.BooleanYN = 1, Flags As %Integer = 0) as %Status [ Language = objectscript ]
Create an Event.
Create an Event in the Security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
Description - Description of the Event
Enabled - Enabled for auditing - 0/1
Flags - Internal use only. Pass 0 for this value.
classmethod Delete(Source As %String, Type As %String, Name As %String) as %Status [ Language = objectscript ]
Delete an Event.
This method will delete an Event from the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
This method also clears the in memory counters.
classmethod Exists(Source As %String = "", Type As %String = "", Name As %String = "", ByRef Event As %ObjectHandle, ByRef Status As %Status) as %Boolean [ Language = objectscript ]
Event exists.
This method checks for the existence of an Event in the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specificationin the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
Return values:
If Value of the method = 0 (Event does not exist, or some error occured)
Event = Null
Status = Event "x" does not exist, or other error message

If Value of the method = 1 (Event exists)
Event = Object handle to Event
Status = $$$OK
classmethod Export(FileName As %String = "EventsExport.xml", ByRef NumExported As %Integer, Sources As %String = "*", Types As %String = "*", Names As %String = "*") as %Status [ Language = objectscript ]
This method exports Event records to a file in xml format.
Parameters:
Filename - Output file name
NumExported (byref) - Returns number of records exported.
Sources - Comma separated list of Sources to export, "*" = All
Types - Comma separated list of Types to export, "*" = All
Names - Comma separated list of event Names to export, "*" = All
classmethod Get(Source As %String, Type As %String, Name As %String, ByRef Properties As %String) as %Status [ Language = objectscript ]
Get an Events properties.
Gets an Events properties from the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
Return values:
Properties - Array of properties
"Description" - Description of the event
"Enabled" - Event is enabled for auditing
"Flags" - Internal use only
classmethod Import(FileName As %String = "EventsExport.xml", ByRef NumImported As %Integer, Flags As %Integer = 0) as %Status [ Language = objectscript ]
Import Event records from an xml file.
Parameters:
FileName - Filename to import Event records from
NumImported (byref) - Returns number of records imported
Flags - Control import
Bit 0 - Do not import records, just return count
Note: On failure, no records will be imported
classmethod Modify(Source As %String = "", Type As %String = "", Name As %String = "", ByRef Properties As %String) as %Status [ Language = objectscript ]
Modify an Event's properties.
Modifies an Event's properties from the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
See the Get() method for a description of the Properties parameter.
If a specific property is not passed in the properties array, the value is not modified.

Queries

query List(EventSources As %String, EventTypes As %String, Events As %String)
Selects Source As %String, Type As %String, Name As %String, Description As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer
Return list of events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions
query ListActivate()
Selects Source As %String, Type As %String, Name As %String, Description As %String, Enabled As %String
Return list of all events which get activated during startup.
Note that Enabled is returned in the internal format (0/1)
Note: This query may change in future versions
query ListAll(EventSources As %String, EventTypes As %String, Events As %String, OwnerFlag As %Integer, Flags As %Integer)
Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean,
Return list of events with counters, including in memory only events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
OwnerFlag - 1 - Return only system defined events.
Flags - 0 - Use "Startswith" as the selection on the name.
Flags - 1 - Use "Contains" as the selection on the name.
Note: This query may change in future versions
query ListAllSystem(EventSources As %String, EventTypes As %String, Events As %String)
Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean, MandatoryBoolean As %Boolean
Return list of System events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions
query ListAllUser(EventSources As %String, EventTypes As %String, Events As %String)
Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean
Return list of User owned events for selection display. EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions
query ListName(ROWSPEC="Name:%String")
SQL Query:
SELECT DISTINCT %EXACT(Name) FROM Events ORDER BY Name
Return list of events. Note: This query may change in future versions
query ListSource(ROWSPEC="Source:%String")
SQL Query:
SELECT DISTINCT %EXACT(Source) FROM Events ORDER BY Source
Return list of event sources. Note: This query may change in future versions
query ListSourceTypeName(EventSources As %String, EventTypes As %String, Events As %String, EventOwner As %Integer, Flags As %Integer)
Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean
List all Event records, combining the Event Source, Event Type, and Name into one column.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions
query ListType(ROWSPEC="Type:%String")
SQL Query:
SELECT DISTINCT %EXACT(Type) FROM Events ORDER BY Type
Return list of event types. Note: This query may change in future versions

Indexes

index (SourceTypeNameLowerCaseIndex on SourceLowerCase,TypeLowerCase,NameLowerCase) [IdKey, Type = key, Unique];
Index methods: SourceTypeNameLowerCaseIndexCheck(), SourceTypeNameLowerCaseIndexDelete(), SourceTypeNameLowerCaseIndexExists(), SourceTypeNameLowerCaseIndexOpen(), SourceTypeNameLowerCaseIndexSQLCheckUnique(), SourceTypeNameLowerCaseIndexSQLExists(), SourceTypeNameLowerCaseIndexSQLFindPKeyByConstraint(), SourceTypeNameLowerCaseIndexSQLFindRowIDByConstraint()

Inherited Members

Inherited Methods

Storage

Storage Model: Storage (Security.Events)

^|$$$SecurityMapEvents|SYS("Security","EventsD")(ID)
=
%%CLASSNAME
Description
Enabled
Flags
Name
Source
Type