Security.Events

persistent class Security.Events extends %Library.Persistent, %XML.Adaptor, %SYSTEM.Help

SQL Table Name: Security.Events

This class defines the Audit Events for the system.

An Event name consists of 3 separate fields:

1) Source - Source of the event
2) Type - Type of the event
3) Event - Name of the event

And Event name is the combination of the 3 fields separated by "/". For example:

%System/%Login/Login

Event names have the following properties:
1) Source, Type, and Event fields are case insensitive.
2) Source, Type, and Event fields cannot contain a "/".
3) Only system defined events can have a Source = "%System" or Source start with a "%".
4) Only system defined events can have a Type start with a "%".


The table for this class should be manipulated only through object access, the published API's or through the System Management Portal. It should not be updated through direct SQL access.

Property Inventory

• Description
• Enabled
• Name
• Source
• Type

Method Inventory

• Clear()
• Create()
• Delete()
• Exists()
• Export()
• Get()
• Import()
• Modify()

Properties

property Description as %String (MAXLEN = 256);

Description of the event.

Property methods: DescriptionDisplayToLogical(), DescriptionGet(), DescriptionGetStored(), DescriptionIsValid(), DescriptionLogicalToDisplay(), DescriptionLogicalToOdbc(), DescriptionNormalize(), DescriptionSet()

property Enabled as Security.Datatype.BooleanYN [ InitialExpression = 0 , Required ];

Event enabled.

Property methods: EnabledDisplayToLogical(), EnabledGet(), EnabledGetStored(), EnabledIsValid(), EnabledLogicalToDisplay(), EnabledLogicalToOdbc(), EnabledLogicalToXSD(), EnabledNormalize(), EnabledOdbcToLogical(), EnabledSet(), EnabledXSDToLogical()

property Name as %String (MAXLEN = 64, MINLEN = 1);

Name of the event.

Property methods: NameDisplayToLogical(), NameGet(), NameGetStored(), NameIsValid(), NameLogicalToDisplay(), NameLogicalToOdbc(), NameNormalize(), NameSet()

property Source as %String (MAXLEN = 64, MINLEN = 1);

Source (system events all have "%System" here).

Property methods: SourceDisplayToLogical(), SourceGet(), SourceGetStored(), SourceIsValid(), SourceLogicalToDisplay(), SourceLogicalToOdbc(), SourceNormalize(), SourceSet()

property Type as %String (MAXLEN = 64, MINLEN = 1);

Type.

Property methods: TypeDisplayToLogical(), TypeGet(), TypeGetStored(), TypeIsValid(), TypeLogicalToDisplay(), TypeLogicalToOdbc(), TypeNormalize(), TypeSet()

Methods

classmethod Clear(EventSources As %String = "*", EventTypes As %String = "*", EventNames As %String = "*") as %Status

Clear the in memory event counters for the specified events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All

classmethod Create(Source As %String, Type As %String, Name As %String, Description As %String = "", Enabled As Security.Datatype.BooleanYN = 1, Flags As %Integer = 0) as %Status

Create an Event.
Create an Event in the Security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
Description - Description of the Event
Enabled - Enabled for auditing - 0/1
Flags - Internal use only. Pass 0 for this value.

classmethod Delete(Source As %String, Type As %String, Name As %String) as %Status

Delete an Event.
This method will delete an Event from the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
This method also clears the in memory counters.

classmethod Exists(Source As %String = "", Type As %String = "", Name As %String = "", ByRef Event As %ObjectHandle, ByRef Status As %Status) as %Boolean

Event exists.
This method checks for the existence of an Event in the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specificationin the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
Return values:
If Value of the method = 0 (Event does not exist, or some error occured)
Event = Null
Status = Event "x" does not exist, or other error message

If Value of the method = 1 (Event exists)
Event = Object handle to Event
Status = $$$OK

classmethod Export(FileName As %String = "EventsExport.xml", ByRef NumExported As %Integer, Sources As %String = "*", Types As %String = "*", Names As %String = "*") as %Status

This method exports Event records to a file in xml format.
Parameters:
Filename - Output file name
NumExported (byref) - Returns number of records exported.
Sources - Comma separated list of Sources to export, "*" = All
Types - Comma separated list of Types to export, "*" = All
Names - Comma separated list of event Names to export, "*" = All

classmethod Get(Source As %String, Type As %String, Name As %String, ByRef Properties As %String) as %Status

Get an Events properties.
Gets an Events properties from the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
Return values:
Properties - Array of properties
"Description" - Description of the event
"Enabled" - Event is enabled for auditing
"Flags" - Internal use only

classmethod Import(FileName As %String = "EventsExport.xml", ByRef NumImported As %Integer, Flags As %Integer = 0) as %Status

Import Event records from an xml file.
Parameters:
FileName - Filename to import Event records from
NumImported (byref) - Returns number of records imported
Flags - Control import
Bit 0 - Do not import records, just return count
Note: On failure, no records will be imported

classmethod Modify(Source As %String = "", Type As %String = "", Name As %String = "", ByRef Properties As %String) as %Status

Modify an Event's properties.
Modifies an Event's properties from the security database.
Parameters:
Source - Source of the Event. This may also contain an entire Event specification in the format Source/Type/Name. If this is the case the Type and Name parameters are ignored.
Type - Type of the Event
Name - Name of the Event
See the Get() method for a description of the Properties parameter.
If a specific property is not passed in the properties array, the value is not modified.

Queries

query List(EventSources As %String, EventTypes As %String, Events As %String)

Selects Source As %String, Type As %String, Name As %String, Description As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer

Return list of events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions

query ListActivate()

Selects Source As %String, Type As %String, Name As %String, Description As %String, Enabled As %String

Return list of all events which get activated during startup.
Note that Enabled is returned in the internal format (0/1)
Note: This query may change in future versions

query ListAll(EventSources As %String, EventTypes As %String, Events As %String, OwnerFlag As %Integer, Flags As %Integer)

Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean,

Return list of events with counters, including in memory only events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
OwnerFlag - 1 - Return only system defined events.
Flags - 0 - Use "Startswith" as the selection on the name.
Flags - 1 - Use "Contains" as the selection on the name.
Note: This query may change in future versions

query ListAllSystem(EventSources As %String, EventTypes As %String, Events As %String)

Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean, MandatoryBoolean As %Boolean

Return list of System events.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions

query ListAllUser(EventSources As %String, EventTypes As %String, Events As %String)

Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean

Return list of User owned events for selection display. EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions

query ListByFilter(Filter As %String, EventOwner As %Integer, Flags As %Integer)

Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean

query ListName(ROWSPEC="Name:%String")

SQL Query:
SELECT DISTINCT %EXACT(Name) FROM Events ORDER BY Name

Return list of events. Note: This query may change in future versions

query ListSource(ROWSPEC="Source:%String")

SQL Query:
SELECT DISTINCT %EXACT(Source) FROM Events ORDER BY Source

Return list of event sources. Note: This query may change in future versions

query ListSourceTypeName(EventSources As %String, EventTypes As %String, Events As %String, EventOwner As %Integer, Flags As %Integer)

Selects EventName As %String, Enabled As %String, Total As %Integer, Written As %Integer, Lost As %Integer, EnabledBoolean As %Boolean

List all Event records, combining the Event Source, Event Type, and Name into one column.
EventSources - Comma separated list of Event Sources, "*" = All
EventTypes - Comma separated list of Types Sources, "*" = All
Events - Comma separated list of Events, "*" = All
Note: This query may change in future versions

query ListType(ROWSPEC="Type:%String")

SQL Query:
SELECT DISTINCT %EXACT(Type) FROM Events ORDER BY Type

Return list of event types. Note: This query may change in future versions

Indexes

index (SourceTypeNameLowerCaseIndex on SourceLowerCase,TypeLowerCase,NameLowerCase) [IdKey, Type = key, Unique];

Index methods: SourceTypeNameLowerCaseIndexCheck(), SourceTypeNameLowerCaseIndexDelete(), SourceTypeNameLowerCaseIndexExists(), SourceTypeNameLowerCaseIndexOpen(), SourceTypeNameLowerCaseIndexSQLCheckUnique(), SourceTypeNameLowerCaseIndexSQLExists(), SourceTypeNameLowerCaseIndexSQLFindPKeyByConstraint(), SourceTypeNameLowerCaseIndexSQLFindRowIDByConstraint()

Inherited Members

Inherited Methods

• %%CLASSNAMELogicalToStorage()
• %%CLASSNAMEStorageToLogical()
• %AddToSaveSet()
• %AddToSyncSet()
• %BMEBuilt()
• %BuildIndicesAsync()
• %BuildIndicesAsyncResponse()
• %CheckConstraints()
• %CheckConstraintsForExtent()
• %ClassIsLatestVersion()
• %ClassName()
• %ComposeOid()
• %ConstructClone()
• %Delete()
• %DeleteExtent()
• %DeleteId()
• %DispatchClassMethod()
• %DispatchGetModified()
• %DispatchGetProperty()
• %DispatchMethod()
• %DispatchSetModified()
• %DispatchSetMultidimProperty()
• %DispatchSetProperty()
• %Exists()
• %ExistsId()
• %Extends()
• %GUID()
• %GUIDSet()
• %GetLock()
• %GetParameter()
• %GetSwizzleObject()
• %Id()
• %InitExtentData()
• %InsertBatch()
• %IsA()
• %IsModified()
• %IsNull()
• %KillExtent()
• %KillExtentData()
• %LoadFromMemory()
• %LockExtent()
• %LockId()
• %New()
• %NormalizeObject()
• %ObjectIsNull()
• %ObjectModified()
• %Oid()
• %OnBeforeAddToSync()
• %OnDeleteFinally()
• %OnDetermineClass()
• %OnOpenFinally()
• %OnSaveFinally()
• %Open()
• %OpenId()
• %OriginalNamespace()
• %PackageName()
• %PhysicalAddress()
• %PurgeIndices()
• %Reload()
• %RemoveFromSaveSet()
• %ResolveConcurrencyConflict()
• %RollBack()
• %Save()
• %SaveDirect()
• %SaveIndices()
• %SerializeObject()
• %SetModified()
• %SortBegin()
• %SortEnd()
• %SyncObjectIn()
• %SyncTransport()
• %UnlockExtent()
• %UnlockId()
• %ValidateIndices()
• %ValidateObject()
• %ValidateTable()
• Help()
• XMLDTD()
• XMLExport()
• XMLExportToStream()
• XMLExportToString()
• XMLNew()
• XMLSchema()
• XMLSchemaNamespace()
• XMLSchemaType()

Storage

Storage Model: Storage (Security.Events)

^|$$$SecurityMapEvents|SYS("Security","EventsD")(ID)

=

%%CLASSNAME Description Enabled Flags Name Source Type Version