Identifier
An identifier is an unique transaction identifier that is generated each time a request is issued or a command is executed. The Identifier can link all the operation logs and the logs (Send Log, Receive Log, and Observe Log) that are on two or more different hosts, because the same value is output simultaneously to all the operation logs and the logs (Send Log, Receive Log, and Observe Log) that are generated from issuance of a request or execution of a command.
Example 1) Investigating the user that issued a request by referring to the Send Log and the Receive Log
Confirming the identifier of the Send Log and the Receive Log, and searching for it in the File Access Log by specifying the identifier of the log allows you to identify the user or starting host that performed the operation.
You can specify the same identifier to search for it in the Command Execution Log of the starting host, to find details regarding request issuance or command execution.
Example 2) Investigating the user that modified the system management information
Specifying the system management information and access type (=update) and searching for them in the File Access Log allows you to identify the user that modified the system management information.
You can specify the identifier to search for in the Command Execution Log to find details regarding request issuance and command execution.
Figure 2.39 Linking Logs by Identifier
Using identifiers in combination with HULFT-HUB
Identifiers are classified as the Latest Identifier or the Starting Identifier.
Usually, the values for these two identifiers are identical. They are not identical when HULFT receives data that was accumulated in HULFT-HUB Server.
In such cases, different identifiers are generated, because HULFT regards accumulation and delivery as different transactions. Therefore, HULFT offers two types of identifier, because such behavior by HULFT does not allow users to link the operation logs and the logs (Send Log, Receive Log, and Observe Log) on the sending side with those on the receiving side. The Starting Identifier maintains the value generated when accumulating data, while the Latest Identifier generates a new value each time delivery is performed.
Figure 2.40 Latest Identifier and Starting Identifier
When HULFT-HUB Server delivers data, the user ID and the starting host name are overwritten in addition to the Latest Identifier. Therefore, when data is accumulated or delivered by HULFT-HUB Server, the only information that links the sending side with the receiving side is the Starting Identifier. Use the Operation Log List Display commands to output the File Access Log and the Command Execution Log, and confirm the Starting Identifier.