Help for Create/Modify Report Selection File

This window lets you select start and end times, select audit events, select 
users and groups, set the minimum and maximum subject and object sensitivity
level ranges, and enter the names of the files you want the selection 
file to cover.  

Selecting Start and End Times 

Use start and end times to select specific sets of audit records.  For 
example, if you suspect that a security-related event occurred between 
certain times, use this feature to select records that were generated during 
that time period.  

Start Time and End Time each contain the five text input fields (boxes).  By 
default, numerical entries for both start and end times are zero (00).  To 
make an entry, click inside a box, then type the date or time.  If you do not 
enter any date or time (by accepting the default or by making the boxes 
blank) the selection file covers all times.  This can generate a very long 
report.  

You can use the mouse or the Tab and Shift-Tab keys to move between text 
input fields.  

If you enter an end time that comes before a start time, or if you enter a 
day, month, year, or time that the Audit subsystem does not recognize, it 
tells you to correct the entry.  These are the possible entries:  

dd (day) 01 to 31.  The system recognizes the number of days in each month, 
and leap year.  

mmm (month) Jan to Dec.  Enter the first three letters of the month.  The 
software is case-insensitive, so you can enter this in uppercase, lowercase, 
or mixed case.  Do not enter numbers corresponding to the month, or place a 
period after the month.  

yy (year) 1970 through the current year.  Enter the last two digits of the 
year.  

hh (hour) 0 through 23.  Use a 24-hour clock where, for example, hour 14 is 2 
p.m. and hour 23 is 11 p.m.  You can leave this blank (or accept the default) 
to include all hours in a day.  

mm (minute) 0 through 59.  You can leave this blank (or accept the default) 
to include all minutes in an hour.  

Selecting Audit Events

Select the events on which you want subsequent reports from the Audit Events 
box.  Click on "Yes" to select an event.  The event remains selected until 
you deselect it.  By default, no events are selected.  

You must select at least one event in order for the Audit subsystem to later 
produce a report.  Select as many audit events as you want for inclusion by 
the report selection file.  

Selecting Files

Use files to select specific audit records.  An audit record is selected if a 
specified name matches any file in the record.  Specify file names as 
absolute path names since all file names are resolved from relative to 
absolute path names by the reports program.  When you designate a file, only 
the events that affect that file are reported on.  If you do not enter a 
file, reports cover all files that pertain to the users and groups you have 
selected.  

To make your selection, click on a line in the Files Selected box.  You can 
enter any legal pathname on each line and up to 50 files.  

Selecting Users and Groups

Select the users and groups on which you want reports.  Scroll through the 
lists of users and groups until you see one that interests you.  Click on a 
user or group to select it.  Select as many users and groups as you like.  
Users and groups remain selected until you deselect them.  If you do not 
select any users or groups, subsequent reports cover all users and groups.  

Setting the Minimum / Maximum  Subject / Object Sensitivity Level

Selecting any of these four buttons brings up a sensitivity level setting
screen to set the appropriate sensitivity level.  The defaults are System 
Low and System High for the minimum and maximum respectively.  These 
changes only take effect if you select the OK button from this screen.  
There is no checking that the minimum is less than the maximum for either the 
subject or object.  When generating a report only those audit events whose
subject and object sensitivity level is between the range specified will
be reported.

Selecting OK or Cancel 

When you select either "OK" or "Cancel" from this screen -- and the operation 
is either performed or cancelled -- the first Create/Modify Report Selection 
Files window reappears so you can work on other selection files if you choose 
to.  Select "Cancel" from this first window to return to the main menubar.  
