# AuditEventRecordType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/audit-3

Audit event record describes a single event (usually data change) in a format suitable for audit.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
timestamp | property dateTime | [1,1] | Timestamp when the event occurred.
eventIdentifier | property string | [1,1] | Unique identification of the event.
sessionIdentifier | property string | [0,1] | Identification of (interactive) session in which the event occurred.
requestIdentifier | property string | [0,1] | Identifier of a request (operation).
taskIdentifier | property string | [0,1] | Task identifier.
taskOID | property string | [0,1] | Task OID.
hostIdentifier | property string | [0,1] | Identifier of a host that generated the audit record.
nodeIdentifier | property string | [0,1] | Identifier of a node in a midPoint cluster that generated the audit record.
remoteHostAddress | property string | [0,1] | Network address of a remote host that originated the request causing this event.
initiatorRef | reference ObjectReferenceType | [1,1] | Initiator is the (legal) entity on behalf of whom is the action executed.
attorneyRef | reference ObjectReferenceType | [0,1] | Attorney is the (physical) user who have executed the action.
effectivePrincipalRef | reference ObjectReferenceType | [0,1] | The effective principal that was used to execute the action.
effectivePrivilegesModification | property EffectivePrivilegesModificationType | [0,1] | Present if the effective privileges used to execute the operation differ or may differ from the regular (declared) privileges of the "effectivePrincipalRef".
targetRef | reference ObjectReferenceType | [0,1] | Object that is a primary target of an operation (if applicable).
targetOwnerRef | reference ObjectReferenceType | [1,1] | Owner of the object that is a target of this operation (if applicable).
eventType | property AuditEventTypeType | [1,1] | Type of audit event.
eventStage | property AuditEventStageType | [1,1] | Stage of event processing: request or execution.
delta | property ObjectDeltaOperationType | [0,-1] | Delta or objects affected by this audit operation.
channel | property string | [0,1] | The channel that was the source of the operation that the record describes
outcome | property OperationResultStatusType | [0,1] | Operation outcome (success, failure)
result | property string | [0,1] | result (e.
parameter | property string | [0,1] | Parameter string, the usage depends on the event type.
message | property string | [0,1] | Optional human readable message, if necessary, e.
changedItem | property ItemPathType | [0,-1] | Represents searchable list of changed item paths related to this audit record.
property | property AuditEventRecordPropertyType | [0,-1] | Represents additional information for which specific property is not available.
reference | property AuditEventRecordReferenceType | [0,-1] | Represents additional reference information for which specific property is not available.
resourceOid | property string | [0,-1] | Resource OIDs.
customColumnProperty | property AuditEventRecordCustomColumnPropertyType | [0,-1] | Field of custom column for audit resord table.
repoId | property long | [0,1] | HIGHLY EXPERIMENTAL! Repository ID.

- ### Items

  - #### timestamp

    Flags: RAM,runtime

    Multiplicity: [1,1]

    Timestamp when the event occurred.

  - #### eventIdentifier

    Flags: RAM,runtime

    Multiplicity: [1,1]

    Unique identification of the event. Every record should have unique event identifier.

  - #### sessionIdentifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identification of (interactive) session in which the event occurred.

  - #### requestIdentifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identifier of a request (operation). All the records that are result of processing of a single request should have the same identifier. In usual case there should be be a single request-stage record and one or more execution-stage records with the same request identifier.

    Please note that this is quite different than task identifier. A single task can make many requests. E.g. a typical reconciliation task will make thousands of operations. All of the audit records from all of those operations will have the same task identifier. But each operation will have a separate request identifier.

  - #### taskIdentifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Task identifier. Operations are executed in a context of a task. This field is an identifier of the task. It is not (necessarily) an OID of the task, as an operation may be executed in an non-persistent (lightweight) task. This field should be populated for all audit records, perhaps except very special system-level records that are executed outside of a task.

    Please note that this is quite different than request identifier. A single task can make many requests. E.g. a typical reconciliation task will make thousands of operations. All of the audit records from all of those operations will have the same task identifier. But each operation will have a separate request identifier.

  - #### taskOID

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Task OID. This field is used for records that are executed in the context of a persistent task.

  - #### hostIdentifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identifier of a host that generated the audit record. This is the host name corresponding to a network interface that accepted the HTTP request.

  - #### nodeIdentifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Identifier of a node in a midPoint cluster that generated the audit record.

  - #### remoteHostAddress

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Network address of a remote host that originated the request causing this event.

  - #### initiatorRef

    Flags: RAM

    Multiplicity: [1,1]

    Initiator is the (legal) entity on behalf of whom is the action executed. It is the subject of the operation. Authorizations of the initiator are used to evaluate access to the operation. This is the entity who is formally responsible for the operation. Although initiator is always a user in midPoint 3.7 and earlier, the initiator may be an organization, a role, or a service in later midPoint versions.

  - #### attorneyRef

    Flags: RAM

    Multiplicity: [0,1]

    Attorney is the (physical) user who have executed the action. This is the user that have logged-in to the user interface. This is the user that pressed the button to execute the action. For the vast majority of cases, this is really an object of UserType. But sometimes it can be a ServiceType (or, very occasionally, maybe RoleType or OrgType - but this does not make much sense).

  - #### effectivePrincipalRef

    Flags: RAM

    Multiplicity: [0,1]

    The effective principal that was used to execute the action. This is the subject whose authorizations were evaluated to determine whether the action is allowed or not. Usually it is the same as initiator. But e.g. when "runAsRef" mechanism is used for expression evaluation (or the like), the effective principal is the one that was used to evaluate the expression.

  - #### effectivePrivilegesModification

    Flags: RAM,runtime,AVals:4

    Multiplicity: [0,1]

    Present if the effective privileges used to execute the operation differ or may differ from the regular (declared) privileges of the "effectivePrincipalRef". This is usually the case e.g. when "runPrivileged" mechanism is used for expression evaluation.

  - #### targetRef

    Flags: RAM

    Multiplicity: [0,1]

    Object that is a primary target of an operation (if applicable). In case that operation targets more than one object, the "primary" or the most important is recorded (e.g. the user object)

  - #### targetOwnerRef

    Flags: RAM

    Multiplicity: [1,1]

    Owner of the object that is a target of this operation (if applicable). E.g. a owner of a task that is being stopped, owner of an account that is being modified, etc.

  - #### eventType

    Flags: RAM,runtime,AVals:16

    Multiplicity: [1,1]

    Type of audit event. It describes what kind of operation was executed (adding an object, modification, user login, ...)

  - #### eventStage

    Flags: RAM,runtime,AVals:3

    Multiplicity: [1,1]

    Stage of event processing: request or execution.

  - #### delta

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Delta or objects affected by this audit operation. NOTE: In future this could be renamed to affectedObjects or similar to better signify that delta may be empty, but object was affected in some way by audit operation.

  - #### channel

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The channel that was the source of the operation that the record describes

  - #### outcome

    Flags: RAM,runtime,AVals:8

    Multiplicity: [0,1]

    Operation outcome (success, failure)

  - #### result

    Flags: RAM,runtime

    Multiplicity: [0,1]

    result (e.g. number of entries, returned object, business result of workflow task or process instance - approved, rejected)

  - #### parameter

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Parameter string, the usage depends on the event type. E.g. username for session start/stop, etc.

  - #### message

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Optional human readable message, if necessary, e.g. an error message.

  - #### changedItem

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Represents searchable list of changed item paths related to this audit record. As of 4.2 this item is only enables usage in Query API against the repository (DB) and is not to be used otherwise. This does NOT have to be all the paths touched by audit record related deltas; e.g. the list of path types stored here may be configurable.

  - #### property

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Represents additional information for which specific property is not available. Conceptually, all the values together represent a multi-map (string -> set of strings).

  - #### reference

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Represents additional reference information for which specific property is not available. Conceptually, all the values together represent a multi-map (string -> set of refs).

  - #### resourceOid

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Resource OIDs. This field is used for resource OIDs of target, when target is FocusType or Shadowtype.

  - #### customColumnProperty

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Field of custom column for audit resord table.

  - #### repoId

    Flags: RAM,runtime

    Multiplicity: [0,1]

    HIGHLY EXPERIMENTAL! Repository ID. This is the ID generated by and stored in DB. For internal use only. Do not use in custom implementations. Do not rely on it. It might change in the future or be removed at all. In the future, might be replaced with container.id.