Information on AUDIT tables (special window: AUDIT)

The AUDIT function is used to display the AUDIT tables in a SLED or system dump (hardware and linkage AUDIT).

If you enter

SHOW-EDITED-INFORMATION INFORMATION=*AUDIT-TABLE-EDIT, WINDOW=<W>

the required dump window W4 - W9 or W21 - W99 is the first window displayed in the current window length. If the dump contains AUDIT tables, one of them is selected and displayed. The title line of the window contains several input fields, by means of which the various AUDIT table types and areas and the required task can be selected.

In addition to the hardware AUDIT, there is also the linkage AUDIT in processor-local (SIH or SIH+TPR) and task-local (TPR and TU) forms. The AUDIT tables are selected by DAMP after the command SHOW-EDITED-INFORMATION INFORMATION=AUDIT-TABLE-EDIT in the sequence “task-local hardware AUDIT (TPR) -> task-local hardware AUDIT (TU) -> tasklocal linkage AUDIT (TPR) -> task-local linkage AUDIT (TU) -> processor-local linkage AUDIT. The first table found is displayed.

Hardware audit will only be supported on /390 servers.

Possible entries in the title line

Figure 51: Entries in the title line of the AUDIT window

• State field
  Here the program status of the required AUDIT tables can be specified:

  SIH TPR TU

  System interrupt handling (only for “Kind = PLA”) Task privileged (only for “Kind = LKA” or “Kind = HWA”) Task unprivileged (only for “Kind = LKA” or “Kind = HWA”)

• LM field
  Indicates the hexadecimal number of the LM (only for “Kind = PLA”)

• TID field
  Indicates the task identifier (only for “Kind = LKA” or “Kind = HWA”)

• TSN field
  Indicates the task sequence number (only for “Kind = LKA” or “Kind = HWA”)

• Kind field
  AUDIT table type:

  PLA LKA HWA

  Processor-local linkage AUDIT Task-local linkage AUDIT Hardware AUDIT

The paging functions+/, ++, - / , +n, -n are supported for AUDIT table output. See "Paging in a diagnostic window" (Modifying the diagnostic windows) for further details.

All addresses can be marked. The addresses are shown in virtual format and where possible edited symbolically (module name + offset).

When the processor-local linkage AUDIT is displayed, the input fields “TID” and “TSN” are not evaluated.

If an AUDIT table is output, the second line shows the addresses of the AUDIT management area (“EXVTLAUD”) and the relevant AUDIT trace table (“AuditTable”). The “AuditTable” field is marked “(current)” if the displayed AUDIT was active at the time of the dump. If the displayed AUDIT was placed in the DISCONTINUE state by the HOLD-LINKAGE-AUDIT or HOLD-HARDWARE-AUDIT command before the dump, “(obsolete)” is added to the “AuditTable” field.

Layout of an AUDIT window

Figure 52: Information on AUDIT tables