Identifier
The Identifier is a unique identifier generated each time a request is issued or a command is executed. The Identifier can link all the operation logs and the logs that are distributed into two or more hosts, because the same value is output to all the operation logs and to the logs, which are generated from single request issuance or single command execution.
Example 1) Tracking down the user who issued a request in the Send Log and the Receive Log
You can identify the user or the starting host that performs the operation by looking up the Identifier in the Send Log or the Receive Log, then searching the File Access Log for the identifier of the log.
Searching the Command Execution Log of the starting host for the same identifier provides you with further details of request issuance or command execution.
Example 2) Tracking down the user who modified system management information
You can identify the user that modified the management information by searching the File Access Log with type of management information and access type (=update) specified.
Searching the Command Execution Log for the identifier provides you with further details of request issuance or command execution.
Figure 2.42 Linking Logs by Identifier
Using Identifier in combination with HULFT-HUB
There are two types of identifier: 'Latest Identifier' and 'Starting Identifier.'
Usually, the values of two identifiers are identical. The value is not identical when HULFT received data that were accumulated in HULFT-HUB Server.
In such case, different identifiers are generated, because HULFT regards accumulation and delivery are different transactions. Therefore, HULFT offers two types of identifier, because such behavior prevents users from linking logs of a sending host including the operation logs with counterparts of a receiving host. The Starting Identifier maintains the value generated upon accumulating, while the Latest Identifier generates new value each time delivery is performed.
Figure 2.43 Latest Identifier and Starting Identifier
When HULFT-HUB Server delivers data, the User ID and the Starting Host Name is overwritten in addition to the Latest Identifier. Therefore, the sole information that links the sending host with the receiving host is the Starting Identifier, when the data are accumulated or delivered by HULFT-HUB Server. Output the File Access Log and the Command Execution Log by using Operation Log List Display commands, and confirm the Starting Identifier.