Name | Type | Multiplicity | Description |
---|---|---|---|
timestamp |
property dateTime |
[1,1] | Timestamp when the event occurred. |
eventIdentifier |
property string |
[1,1] | Unique identification of the event. |
sessionIdentifier |
property string |
[0,1] | Identification of (interactive) session in which the event occurred. |
requestIdentifier |
property string |
[0,1] | Identifier of a request (operation). |
taskIdentifier |
property string |
[0,1] | Task identifier. |
taskOID |
property string |
[0,1] | Task OID. |
hostIdentifier |
property string |
[0,1] | Identifier of a host that generated the audit record. |
nodeIdentifier |
property string |
[0,1] | Identifier of a node in a midPoint cluster that generated the audit record. |
remoteHostAddress |
property string |
[0,1] | Network address of a remote host that originated the request causing this event. |
initiatorRef |
reference ObjectReferenceType |
[1,1] | Initiator is the (legal) entity on behalf of whom is the action executed. |
attorneyRef |
reference ObjectReferenceType |
[0,1] | Attorney is the (physical) user who have executed the action. |
effectivePrincipalRef |
reference ObjectReferenceType |
[0,1] | The effective principal that was used to execute the action. |
effectivePrivilegesModification |
property EffectivePrivilegesModificationType |
[0,1] | Present if the effective privileges used to execute the operation differ or may differ from the regular (declared) privileges of the "effectivePrincipalRef". |
targetRef |
reference ObjectReferenceType |
[0,1] | Object that is a primary target of an operation (if applicable). |
targetOwnerRef |
reference ObjectReferenceType |
[1,1] | Owner of the object that is a target of this operation (if applicable). |
eventType |
property AuditEventTypeType |
[1,1] | Type of audit event. |
eventStage |
property AuditEventStageType |
[1,1] | Stage of event processing: request or execution. |
delta |
property ObjectDeltaOperationType |
[0,-1] | Delta or objects affected by this audit operation. |
channel |
property string |
[0,1] | The channel that was the source of the operation that the record describes |
outcome |
property OperationResultStatusType |
[0,1] | Operation outcome (success, failure) |
result |
property string |
[0,1] | result (e. |
parameter |
property string |
[0,1] | Parameter string, the usage depends on the event type. |
message |
property string |
[0,1] | Optional human readable message, if necessary, e. |
changedItem |
property ItemPathType |
[0,-1] | Represents searchable list of changed item paths related to this audit record. |
property |
property AuditEventRecordPropertyType |
[0,-1] | Represents additional information for which specific property is not available. |
reference |
property AuditEventRecordReferenceType |
[0,-1] | Represents additional reference information for which specific property is not available. |
resourceOid |
property string |
[0,-1] | Resource OIDs. |
customColumnProperty |
property AuditEventRecordCustomColumnPropertyType |
[0,-1] | Field of custom column for audit resord table. |
repoId |
property long |
[0,1] | HIGHLY EXPERIMENTAL! Repository ID. |
Flags: RAM,runtime
Multiplicity: [1,1]
Flags: RAM,runtime
Multiplicity: [1,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Identifier of a request (operation). All the records that are result of
processing of a single request should have the same identifier.
In usual case there should be be a single request-stage record
and one or more execution-stage records with the same request
identifier.
Please note that this is quite different than task identifier.
A single task can make many requests. E.g. a typical reconciliation
task will make thousands of operations. All of the audit records from
all of those operations will have the same task identifier. But each
operation will have a separate request identifier.
Flags: RAM,runtime
Multiplicity: [0,1]
Task identifier. Operations are executed in a context of a task.
This field is an identifier of the task. It is not (necessarily) an
OID of the task, as an operation may be executed in an non-persistent
(lightweight) task. This field should be populated for all audit records,
perhaps except very special system-level records that are executed outside
of a task.
Please note that this is quite different than request identifier.
A single task can make many requests. E.g. a typical reconciliation
task will make thousands of operations. All of the audit records from
all of those operations will have the same task identifier. But each
operation will have a separate request identifier.
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM
Multiplicity: [1,1]
Flags: RAM
Multiplicity: [0,1]
Flags: RAM
Multiplicity: [0,1]
Flags: RAM,runtime,AVals:4
Multiplicity: [0,1]
Flags: RAM
Multiplicity: [0,1]
Flags: RAM
Multiplicity: [1,1]
Flags: RAM,runtime,AVals:16
Multiplicity: [1,1]
Flags: RAM,runtime,AVals:3
Multiplicity: [1,1]
Flags: RAM,runtime
Multiplicity: [0,-1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime,AVals:8
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,1]
Flags: RAM,runtime
Multiplicity: [0,-1]
Flags: RAM,runtime
Multiplicity: [0,-1]
Flags: RAM,runtime
Multiplicity: [0,-1]
Flags: RAM,runtime
Multiplicity: [0,-1]
Flags: RAM,runtime
Multiplicity: [0,-1]
Flags: RAM,runtime
Multiplicity: [0,1]