Identifier

The Identifier is a unique identifier generated each time a request is issued or a command is executed. The Identifier can link all the operation log records and other log records that are distributed over two or more hosts, because the same string is output to all the log records that are generated from the same issuance of the request or execution of the command.

Example 1) Determining which user issued a request using the Send Log or the Receive Log

You can identify the user or starting host that performed the operation by looking up the Identifier in the Send Log or the Receive Log, and then searching for it in the File Access Log by specifying the Identifier of the log.

Specifying the same Identifier to search the Command Execution Log of the starting host provides you with the details of the issuance of the request or execution of the command.

Example 2) Determining which user modified the system management information

You can identify the user that modified the management information, as well as the Identifier, by specifying the system management information type and access type (=update) and searching for them in the File Access Log.

Specifying the Identifier to search the Command Execution Log provides you with the details of the issuance of the request or execution of the command.

Figure 2.37 Linking Logs by Identifier

Using Identifier in combination with HULFT-HUB

There are two types of Identifiers, the Latest Identifier and the Starting Identifier.

Usually, the strings of the two identifiers are identical. The strings are not identical when HULFT receives data that was accumulated in HULFT-HUB Server.

In this case, different Identifiers are generated, because HULFT regards accumulation and delivery as different transactions. However, if the Identifiers are different, users cannot to link the operation log records and other log records on the host on the sending side with those on the host on the receiving side. Therefore, HULFT offers the following two types of Identifiers:

  • Starting Identifier

    This Identifier maintains the string that was generated when HULFT-HUB Server started to accumulate data.

  • Latest Identifier

    This Identifier generates a new string each time delivery is performed from HULFT-HUB Server.

Figure 2.38 Latest Identifier and Starting Identifier

Note

When HULFT-HUB Server delivers data, the user ID and the starting host name are overwritten in addition to the Latest Identifier. Therefore, the Starting Identifier is the only information that links the operation log records and other log records on the host on the sending side with those on the host on the receiving side, when the data is accumulated and delivered by HULFT-HUB Server. To determine the Starting Identifier, output records in the File Access Log and the Command Execution Log by running the Operation Log List Display (XROPLLST) command.