Editing the SATLOG files is the task of SAT file management or SAT file evaluation. The utility routine used for evaluation is SATUT, under the SYSAUDIT user ID.
It is executable independently of the SAT subsystem SATCP under any user ID that has the SAT-FILE-MANAGEMENT or SAT-FILE-EVALUATION privilege.
In addition to SATLOG files, SATUT can also include CONSLOG files (see "Tables of auditable information on object-related events (1)") in the evaluation.
The SAT evaluation routine SATUT offers the following functions:
It uses the input files to create edited files (replacement files) containing the securityrelevant data selected by SAT file management or SAT file evaluation. In this case the function of SAT is to reduce the volume of data and store security-relevant records, i.e. the input files can be replaced by the edited files.
It selects specific audit records from the input files on the basis of certain selection conditions. The selected records are then output to printer (SYSLST) or an XML file, presented as statistics or written to a file (analysis file). In this case, the function of SATUT is to analyze selected event groups, i.e. the input files are not replaced by the edited files.