---------------------------------------------------------------------- ELOQUENCE B.07.10 - patch PE71-0807030 ---------------------------------------------------------------------- This patch adds enhancements or fixes defects of the fwaudit utility as released with Eloquence B.07.10. This patch will be integrated in the Eloquence B.07.10 release. Eloquence B.07.10 must be installed before applying this patch. Severity: PE71-0807030: BUG FIX Superseded patches: PE71-0803041: BUG FIX PE71-0801243: BUG FIX PE71-0710031: ENHANCEMENT PE71-0705231: BUG FIX PE71-0705230: BUG FIX PE71-0608010: BUG FIX PE71-0606293: BUG FIX PE71-0602283: ENHANCEMENT Patch PE71-0807030 ------------------ Platforms: All * An overflow of the internal expression stack causes the fwaudit utility to abort with a message like below: Error in filter expression: expression too complex Originally, the capacity of the message stack was 100 elements. This has been increased to 1000 elements to allow more complex filter expressions. * Changed the Windows file version to "7.1.0.14" Patch PE71-0803041 ------------------ Platforms: All * The new -m command line option was added to output TurboIMAGE DBMEMO and DBBEGIN/DBEND records. The -m option may be combined with the -r option (print clear text report). Previously, TurboIMAGE DBMEMO and DBBEGIN/DBEND records were only output if the -r option combined with the -v option were specified. The new -m option now allows a more specific selection about what information is being output. * TurboIMAGE DBMEMO and DBBEGIN/DBEND record data is now output in clear text. Any non-printable characters are printed as octal escape sequences (the same way item values are output). Previously, the hexdump output format was used, which may now be explicitly selected with the -x command line option. * TurboIMAGE DBMEMO and DBBEGIN/DBEND records may now be filtered by session and timestamp information. Previously, DBMEMO and DBBEGIN/DBEND records were not subject to filtering. This behavior was changed. A session and/or timestamp filter expression now affects DBMEMO and DBBEGIN/DBEND records in addition to IMAGE operations. Other parts of the filter expression (for example, filter by record number or item value) are ignored when filtering DBMEMO and DBBEGIN/DBEND records. For example, consider the filter expression below: login={jdoe} and timestamp between 2005-07-27 2005-07-28 and dbput and *.customers and custno="090667" The "login={jdoe}" (filter on session info) and "timestamp between 2005-07-27 2005-07-28" (filter on timestamp) expressions now also affect any existing DBMEMO and DBBEGIN/DBEND records in addition to the DBPUT filter condition on IMAGE operations specified in the second line. DBMEMO and DBBEGIN/DBEND records that do not belong to a session where the login was "jdoe" or that do not match the specified timestamp interval are not output, except if IMAGE operations are covered by the timestamp interval but the associated DBMEMO and DBBEGIN/DBEND records are not (see below). * If a timestamp filter condition is used which would output the IMAGE operations but not the associated DBMEMO and DBBEGIN/DBEND records, the associated DBMEMO and DBBEGIN/DBEND records are output anyhow so that the context the IMAGE operations is always complete. * The MEMO tag type in the audit file format was modified to include the timestamp when the MEMO record was originally written. The new MEMO tag type is encoded as '7' (55 / 0x37). The old MEMO tag type '6' (54 / 0x36) is now obsolete. MEMO record format: fixed part * 4 byte (unsigned 32bit) : session number * 4 byte (unsigned 32bit) : timestamp (time_t) * 4 byte (signed 32bit) : mode (*) variable part * [remaining record size] bytes: MEMO data (*) Mode encoding: - 'm' (109 / 0x6d) : DBMEMO - 'b' ( 98 / 0x62) : DBBEGIN - 'e' (101 / 0x65) : DBEND * A problem was fixed on writing an audit file header. When fwaudit was used to read from an audit file to create another audit file (-o command line option) the character set entry in the audit file header could become incorrectly set to 65535 (unknown character set). * A problem was fixed on writing MEMO records to an audit file. When fwaudit was used to read from an audit file to create another audit file (-o command line option) any MEMO records were not copied from the original audit file to the new file. * Changed the Windows file version to "7.1.0.13" Patch PE71-0801243 ------------------ Platforms: All * Fixed a problem related to using wildcards in a filter expression (#3498). String values starting with a wildcard character caused a syntax error. * Changed the Windows file version to "7.1.0.12" Patch PE71-0710031 ------------------ Platforms: All * Experimental support was added to filter by TurboIMAGE DBMEMO and DBBEGIN/DBEND information. A DBMEMO filter expression applies to any database modification following a matching DBMEMO information record until the next DBMEMO or DBBEGIN or DBEND occurs in the forward-log file. A DBBEGIN filter expression applies to any database modification following a matching DBBEGIN information record until the next DBBEGIN or DBEND occurs in the forward-log file. A DBEND filter expression applies to any database modification following a matching DBEND information record until the next DBBEGIN or DBEND occurs in the forward-log file. The syntax is: DBMEMO relational-op {text} DBMEMO BETWEEN {text} AND {text} DBBEGIN relational-op {text} DBBEGIN BETWEEN {text} AND {text} DBEND relational-op {text} DBEND BETWEEN {text} AND {text} relational-op: < <= = <> >= > integral-value: session identifier to compare with The comparison is not case sensitive. Wildcards may be used if either the = or the <> operator is applied. If using BETWEEN, the AND keyword may be omitted. For example, to find all database modifications marked by a DBMEMO information which starts with "accounting" and contains the word "maintenance": DBMEMO = {accounting*maintenance*} Please note that by default the TurboIMAGE DBMEMO/DBBEGIN/DBEND intrinsics do not write to the forward-log. This must be explicitly enabled through the HP3K_API_COMPAT database property (where bit 0 enables DBMEMO and bit 1 enables DBBEGIN and DBEND) and requires that image3k library revision B.07.10.09 or newer is installed. * Added the MEMO tag type to the audit file format. The MEMO tag type is encoded as '6' (54 / 0x36). MEMO record format: fixed part * 4 byte (unsigned 32bit) : session number * 4 byte (signed 32bit) : mode (*) variable part * [remaining record size] bytes: MEMO data (*) Mode encoding: - 'm' (109 / 0x6d) : DBMEMO - 'b' ( 98 / 0x62) : DBBEGIN - 'e' (101 / 0x65) : DBEND * Changed the Windows file version to "7.1.0.11" Patch PE71-0705231 ------------------ Platforms: All * The previous patch PE71-0705230 introduced a problem where numeric filter values could cause unexpected results. * Changed the Windows file version to "7.1.0.10" Patch PE71-0705230 ------------------ Platforms: All * If the same item name is used with different types in different databases, fwaudit could fail with an error message indicating a wrong syntax was used (#3370). item requires a string filter argument This could happen when a numeric item value is used in a filter expression. If an item with the same name exists in another database that has a non-numeric item type (X, U or B), fwaudit aborted on any record referring to that item. item requires a numeric filter argument This could happen if a string item value is used in a filter expression and fwaudit encountered an item with the same name that has a numeric item type. As a solution, fwaudit now accepts both string and numeric values on all item types. For numeric item types, if a string can be converted to a numeric value, it will be used, otherwise the value does not match and fwaudit continues. For string item types, a numeric value will be used literally for an alphanumeric comparison. * The "id" session item was added to allow to filter by a specific session identifier (#3343). The syntax is: id relational-op {integral-value} id BETWEEN {integral-value} AND {integral-value} relational-op: < <= = <> >= > integral-value: session identifier to compare with If using BETWEEN, the AND keyword may be omitted. For example: id = {42} ID BETWEEN {108} AND {110} * The "conntime" session item was added to allow to filter by the session connection timestamp (#3343). The syntax is: conntime relational-op {date-time-value} conntime BETWEEN {date-time-value} AND {date-time-value} relational-op: < <= = <> >= > date-time-value: YYYY-MM-DD HH:MM:SS MM/DD/YYYY HH:MM:SS DD.MM.YYYY HH:MM:SS In date-time-value, the time part is optional (defaults to 00:00:00). If using BETWEEN, the AND keyword may be omitted. For example: conntime >= {2005-07-26} conntime between {07/26/2005 10:00} and {07/26/2005 12:00} CONNTIME BETWEEN {26.07.2005 15:31:40} {26.07.2005 15:31:50} * Changed the Windows file version to "7.1.0.9" Patch PE71-0608010 ------------------ Platforms: All * The fwaudit utility was incompatible with previous forward-log file revision 1.1 to 1.3. * Changed the Windows file version to "7.1.0.8" Patch PE71-0606293 ------------------ Platforms: All * The fwaudit utility was modified to add support for the modified forward-log file format added with eloqdb6 patch PE71-0606290. * Changed the Windows file version to "7.1.0.7" Notes / Related patches: - The following related patches (or superseding) should be installed with this patch: - PE71-0606290 - eloqdb6 server - PE71-0606291 - dblogreset utility - PE71-0606292 - dbrecover utility Patch PE71-0602283 ------------------ Platforms: All * The fwaudit utility was modified to add support for the modified forward-log file format added with eloqdb6 patch PE71-0602280. The eloqdb6 server process was enhanced to use a more efficient format to record index and meta data changes. This enhancement results in a substantial reduction in disk space for the forward-log file when index entries are changed frequently. This change required a modification of the forward-log file format. While older forward-log files are still supported, related utility programs need to be updated to handle the new format. Notes / Related patches: - The following related patches (or superseding) should be installed with this patch: - PE71-0602280 - eloqdb6 server - PE71-0602283 - dblogreset utility - PE71-0602282 - dbrecover utility Installation: ------------- Please download the patch archive that corresponds with the installed release. The patch files follow the conventions below: PE71-0807030-hpux-ia64.tar.gz ^ ^ ^ | | Architecture / OS specific build | Operating system Patch ID HP-UX: In order to install this patch, you need to unpack it with gzip and tar. Gzip is included with HP-UX. Installation requires root privileges. cd /opt/eloquence6 gzip -dc /path/to/PE71-0807030-hpux.tar.gz | tar xf - Files: bin/fwaudit share/doc/PE71-0807030-README Linux: In order to install this patch, you need to unpack it with tar. Installation requires root privileges. cd /opt/eloquence6 tar xzf /path/to/PE71-0807030-linux.tar.gz Files: bin/fwaudit share/doc/PE71-0807030-README Windows XP/2000/NT: This patch should *only* be installed if you previously installed the Eloquence server components on your system. Installation requires administrative capabilities. Two options are available for patch installation. The patch is available as self extracting archive for automatic installation and as a zip archive for manual installation. Both patches are equivalent. Installation requires administrative capabilities. For autmatic installation of this patch, please download the patch file PE71-0807030-win32.exe file. Before installation, please consider closing all applications and execute the patch installation program. Installation does not require a reboot unless the patched files were active. For a manual installation of the patch, please download the patch file PE71-0807030-win32.zip file and unpack its contents. Then perform the following steps: * Please copy the fwaudit.exe file into the bin subdirectory of your Eloquence installation (for example C:\Programs\Eloquence\bin). * Please copy the PE71-0807030-README.txt file into the share\doc subdirectory of your Eloquence installation (for example C:\Programs\Eloquence\share\doc). Files: fwaudit.exe PE71-0807030-README.txt