----------------------------------------------------------------------

ELOQUENCE B.07.10 - patch PE71-1001270

----------------------------------------------------------------------

This patch adds enhancements or fixes defects of the fwaudit utility
as released with Eloquence B.07.10. This patch will be integrated in 
the Eloquence B.07.10 release.

Eloquence B.07.10 must be installed before applying this patch.

Severity:
 PE71-1001270: BUG FIX

Superseded patches:
 PE71-0906051: BUG FIX
 PE71-0812030: BUG FIX
 PE71-0807030: BUG FIX
 PE71-0803041: BUG FIX
 PE71-0801243: BUG FIX
 PE71-0710031: ENHANCEMENT
 PE71-0705231: BUG FIX
 PE71-0705230: BUG FIX
 PE71-0608010: BUG FIX
 PE71-0606293: BUG FIX
 PE71-0602283: ENHANCEMENT


Patch PE71-1001270
------------------

Platforms: All

* A problem was fixed where under certain conditions a session SIGN-ON
  record was not output (#3932).

  If TurboIMAGE DBMEMO and/or DBBEGIN/DBEND records are present in the
  forward-log but the -m command line option was not specified to output
  these records, the associated session SIGN-ON records were not output.

* When processing an audit file, any comment records are now output to
  stderr, no longer to stdout (#3923).

  Audit comment records are used to record any problems that may have
  occurred while the original forward-log was processed. When an archived
  audit file is later used with fwaudit, these comment record messages
  are now output to stderr. Previously they were output to stdout along
  with the clear-text report.
  
  In addition, the warning messages written to comment records have been
  revised so that they now clearly indicate that they were created while
  the original forward-log was processed. 

* Fixed a minor internal memory leak (#3872).

* Changed the Windows file version to "7.1.0.17"


Patch PE71-0906051
------------------

Platforms: All

* Using wildcards in a filter expression could in some cases cause
  unexpected results.

  A filter expression could return a mismatch if characters after a
  * wildcard would potentially match multiple times.

  For example, the string "eloquence" would match the "e" in a filter
  expression like "*e" three times, but only the last match would be
  valid. In a situation like this, a mismatch could be returned.
  
* Changed the Windows file version to "7.1.0.16"


Patch PE71-0812030
------------------

Platforms: All

* While processing a forward-log file, an unexpected end-of file
  condition caused by a previous database server abort was not
  always handled correctly (#3688).

* Changed the Windows file version to "7.1.0.15"


Patch PE71-0807030
------------------

Platforms: All

* An overflow of the internal expression stack caused the fwaudit
  utility to abort with a message like below:

    Error in filter expression: expression too complex

  Originally, the capacity of the expression stack was 100 elements.
  This has been increased to 1000 elements to allow more complex
  filter expressions.

* Changed the Windows file version to "7.1.0.14"


Patch PE71-0803041
------------------

Platforms: All

* The new -m command line option was added to output TurboIMAGE DBMEMO
  and DBBEGIN/DBEND records. The -m option may be combined with the
  -r option (print clear text report).

  Previously, TurboIMAGE DBMEMO and DBBEGIN/DBEND records were only
  output if the -r option combined with the -v option were specified.
  The new -m option now allows a more specific selection about what
  information is being output.

* TurboIMAGE DBMEMO and DBBEGIN/DBEND record data is now output in
  clear text. Any non-printable characters are printed as octal escape
  sequences (the same way item values are output).

  Previously, the hexdump output format was used, which may now be
  explicitly selected with the -x command line option.

* TurboIMAGE DBMEMO and DBBEGIN/DBEND records may now be filtered by
  session and timestamp information.

  Previously, DBMEMO and DBBEGIN/DBEND records were not subject to
  filtering. This behavior was changed.

  A session and/or timestamp filter expression now affects DBMEMO and
  DBBEGIN/DBEND records in addition to IMAGE operations. Other parts
  of the filter expression (for example, filter by record number or
  item value) are ignored when filtering DBMEMO and DBBEGIN/DBEND
  records.

  For example, consider the filter expression below:

    login={jdoe} and timestamp between 2005-07-27 2005-07-28
    and dbput and *.customers and custno="090667" 

  The "login={jdoe}" (filter on session info) and "timestamp between
  2005-07-27 2005-07-28" (filter on timestamp) expressions now also
  affect any existing DBMEMO and DBBEGIN/DBEND records in addition to
  the DBPUT filter condition on IMAGE operations specified in the
  second line.

  DBMEMO and DBBEGIN/DBEND records that do not belong to a session
  where the login was "jdoe" or that do not match the specified
  timestamp interval are not output, except if IMAGE operations are
  covered by the timestamp interval but the associated DBMEMO and
  DBBEGIN/DBEND records are not (see below).

* If a timestamp filter condition is used which would output the
  IMAGE operations but not the associated DBMEMO and DBBEGIN/DBEND
  records, the associated DBMEMO and DBBEGIN/DBEND records are output
  anyhow so that the context the IMAGE operations is always complete.

* The MEMO tag type in the audit file format was modified to include
  the timestamp when the MEMO record was originally written.

  The new MEMO tag type is encoded as '7' (55 / 0x37). The old MEMO
  tag type '6' (54 / 0x36) is now obsolete.

  MEMO record format:

    fixed part
    * 4 byte (unsigned 32bit) : session number
    * 4 byte (unsigned 32bit) : timestamp (time_t)
    * 4 byte (signed 32bit)   : mode (*)

    variable part
    * [remaining record size] bytes: MEMO data

    (*) Mode encoding:
       - 'm' (109 / 0x6d) : DBMEMO
       - 'b' ( 98 / 0x62) : DBBEGIN
       - 'e' (101 / 0x65) : DBEND

* A problem was fixed on writing an audit file header.

  When fwaudit was used to read from an audit file to create another
  audit file (-o command line option) the character set entry in the
  audit file header could become incorrectly set to 65535 (unknown
  character set).

* A problem was fixed on writing MEMO records to an audit file.

  When fwaudit was used to read from an audit file to create another
  audit file (-o command line option) any MEMO records were not copied
  from the original audit file to the new file.

* Changed the Windows file version to "7.1.0.13"


Patch PE71-0801243
------------------

Platforms: All

* Fixed a problem related to using wildcards in a filter expression
  (#3498). String values starting with a wildcard character caused
  a syntax error.

* Changed the Windows file version to "7.1.0.12"


Patch PE71-0710031
------------------

Platforms: All

* Experimental support was added to filter by TurboIMAGE DBMEMO
  and DBBEGIN/DBEND information.

  A DBMEMO filter expression applies to any database modification
  following a matching DBMEMO information record until the next
  DBMEMO or DBBEGIN or DBEND occurs in the forward-log file.

  A DBBEGIN filter expression applies to any database modification
  following a matching DBBEGIN information record until the next
  DBBEGIN or DBEND occurs in the forward-log file.

  A DBEND filter expression applies to any database modification
  following a matching DBEND information record until the next
  DBBEGIN or DBEND occurs in the forward-log file.

  The syntax is:

    DBMEMO relational-op {text}
    DBMEMO BETWEEN {text} AND {text}

    DBBEGIN relational-op {text}
    DBBEGIN BETWEEN {text} AND {text}

    DBEND relational-op {text}
    DBEND BETWEEN {text} AND {text}

    relational-op:
      <   <=   =   <>   >=   > 

    integral-value:
      session identifier to compare with

  The comparison is not case sensitive. Wildcards may be used if
  either the = or the <>  operator is applied.
  If using BETWEEN, the AND keyword may be omitted.

  For example, to find all database modifications marked by a DBMEMO
  information which starts with "accounting" and contains the word
  "maintenance":

    DBMEMO = {accounting*maintenance*}

  Please note that by default the TurboIMAGE DBMEMO/DBBEGIN/DBEND
  intrinsics do not write to the forward-log. This must be explicitly
  enabled through the HP3K_API_COMPAT database property (where bit 0
  enables DBMEMO and bit 1 enables DBBEGIN and DBEND) and requires
  that image3k library revision B.07.10.09 or newer is installed.

* Added the MEMO tag type to the audit file format.

  The MEMO tag type is encoded as '6' (54 / 0x36).

  MEMO record format:

    fixed part
    * 4 byte (unsigned 32bit) : session number
    * 4 byte (signed 32bit)   : mode (*)

    variable part
    * [remaining record size] bytes: MEMO data

    (*) Mode encoding:
       - 'm' (109 / 0x6d) : DBMEMO
       - 'b' ( 98 / 0x62) : DBBEGIN
       - 'e' (101 / 0x65) : DBEND

* Changed the Windows file version to "7.1.0.11"


Patch PE71-0705231
------------------

Platforms: All

* The previous patch PE71-0705230 introduced a problem where numeric
  filter values could cause unexpected results.

* Changed the Windows file version to "7.1.0.10"


Patch PE71-0705230
------------------

Platforms: All

* If the same item name is used with different types in different
  databases, fwaudit could fail with an error message indicating 
  a wrong syntax was used (#3370).
  
    item requires a string filter argument

  This could happen when a numeric item value is used in a filter
  expression. If an item with the same name exists in another
  database that has a non-numeric item type (X, U or B), fwaudit
  aborted on any record referring to that item.

    item requires a numeric filter argument

  This could happen if a string item value is used in a filter 
  expression and fwaudit encountered an item with the same name that 
  has a numeric item type.

  As a solution, fwaudit now accepts both string and numeric values
  on all item types. For numeric item types, if a string can be
  converted to a numeric value, it will be used, otherwise the value
  does not match and fwaudit continues. For string item types, a
  numeric value will be used literally for an alphanumeric comparison.

* The "id" session item was added to allow to filter by a specific
  session identifier (#3343).

  The syntax is:

    id relational-op {integral-value}
    id BETWEEN {integral-value} AND {integral-value}

    relational-op:
      <   <=   =   <>   >=   > 

    integral-value:
      session identifier to compare with

  If using BETWEEN, the AND keyword may be omitted.

  For example:

    id = {42}
    ID BETWEEN {108} AND {110}

* The "conntime" session item was added to allow to filter by the
  session connection timestamp (#3343).

  The syntax is:

    conntime relational-op {date-time-value}
    conntime BETWEEN {date-time-value} AND {date-time-value}

    relational-op:
      <   <=   =   <>   >=   > 

    date-time-value:
      YYYY-MM-DD HH:MM:SS
      MM/DD/YYYY HH:MM:SS
      DD.MM.YYYY HH:MM:SS

  In date-time-value, the time part is optional
  (defaults to 00:00:00).
  If using BETWEEN, the AND keyword may be omitted.

  For example:

    conntime >= {2005-07-26}
    conntime between {07/26/2005 10:00} and {07/26/2005 12:00}
    CONNTIME BETWEEN {26.07.2005 15:31:40} {26.07.2005 15:31:50}

* Changed the Windows file version to "7.1.0.9"


Patch PE71-0608010
------------------

Platforms: All

* The fwaudit utility was incompatible with previous forward-log
  file revision 1.1 to 1.3.

* Changed the Windows file version to "7.1.0.8"


Patch PE71-0606293
------------------

Platforms: All

* The fwaudit utility was modified to add support for the modified
  forward-log file format added with eloqdb6 patch PE71-0606290.

* Changed the Windows file version to "7.1.0.7"


Notes / Related patches:

- The following related patches (or superseding) should be installed 
  with this patch:
  - PE71-0606290 - eloqdb6 server
  - PE71-0606291 - dblogreset utility
  - PE71-0606292 - dbrecover utility


Patch PE71-0602283
------------------

Platforms: All

* The fwaudit utility was modified to add support for the modified
  forward-log file format added with eloqdb6 patch PE71-0602280.
 
  The eloqdb6 server process was enhanced to use a more efficient 
  format to record index and meta data changes. 
  This enhancement results in a substantial reduction in disk space
  for the forward-log file when index entries are changed frequently.
 
  This change required a modification of the forward-log file format.
  While older forward-log files are still supported, related utility
  programs need to be updated to handle the new format.


Notes / Related patches:

- The following related patches (or superseding) should be installed 
  with this patch:
  - PE71-0602280 - eloqdb6 server
  - PE71-0602283 - dblogreset utility
  - PE71-0602282 - dbrecover utility


Installation:
-------------

Please download the patch archive that corresponds with the installed
release.  The patch files follow the conventions below:

   PE71-1001270-hpux-ia64.tar.gz
        ^       ^    ^
        |       |    Architecture / OS specific build
        |       Operating system
        Patch ID


HP-UX:

In order to install this patch, you need to unpack it with gzip and tar.
Gzip is included with HP-UX. Installation requires root privileges.

cd /opt/eloquence6
gzip -dc /path/to/PE71-1001270-hpux.tar.gz | tar xf -

Files:

   bin/fwaudit
   share/doc/PE71-1001270-README


Linux:

In order to install this patch, you need to unpack it with tar.
Installation requires root privileges.

cd /opt/eloquence6
tar xzf /path/to/PE71-1001270-linux.tar.gz

Files:

   bin/fwaudit
   share/doc/PE71-1001270-README


Windows XP/2000/NT:

This patch should *only* be installed if you previously installed
the Eloquence server components on your system.
Installation requires administrative capabilities.

Two options are available for patch installation. The patch is
available as self extracting archive for automatic installation
and as a zip archive for manual installation. Both patches are
equivalent. Installation requires administrative capabilities.

For autmatic installation of this patch, please download the patch
file PE71-1001270-win32.exe file. Before installation, please
consider closing all applications and execute the patch installation
program. Installation does not require a reboot unless the patched
files were active.

For a manual installation of the patch, please download the
patch file PE71-1001270-win32.zip file and unpack its contents.
Then perform the following steps:

* Please copy the fwaudit.exe file into the bin subdirectory of your
  Eloquence installation (for example C:\Programs\Eloquence\bin).

* Please copy the PE71-1001270-README.txt file into the share\doc
  subdirectory of your Eloquence installation (for example
  C:\Programs\Eloquence\share\doc).

Files:

   fwaudit.exe
   PE71-1001270-README.txt