This tool is meant for Oracle Internal use only. Please do not file bugs on this, if you see any problems with the tool, report to auditdev_ww@oracle.com.
Using this tool you can define all the events that your component will be using, and also define the filter levels. Then you can save this event definition file along with your other code in your own VOB, and supply it when you are registering with CAS.
EM Audit FS: http://files.oraclecorp.com/content/MySharedFolders/ST%20Functional%20Specs/AS11gR1/EM/Audit/20609_Audit-EM-FS.doc
There are a set of generic events and categories. When you bring up the tool for the first time, you will see these events. You can use some events from this list and also define new ones. You must mark all the generic audit events that you will be using. Go to each of the events that you will be using at click on the "Use" checkbox.
Once you marked an event as "Used", you can also extend it - a) you can add new attributes or b)mark existing attributes as unused or c) override the helpText.
To create new events, right click on the category to which this event should belong, and create the event.
You can create new categories, and move your events from one category to another.
Note: Event names must be unique, not only across categories, but also across components. Send your event definition to the auditdev_ww and we will ensure that other components are not defining similar events (If they are we will probably make it into a generic event).
The Event Name must be maximum of 30 characters, should be all alphanumeric, but start with an alphabet. This restriction is placed because the Event name is directly used as a DB column name, and as a java and C identifiers.
You can also define a short name for an event. The short name is used in C source generation to get around the ANSI C limitation of 31 chars for an identifier name. The short name should be around 10 chars or less. It also needs to be unique.
Attributes can be defined at three levels
At each level, there are generic attributes, but you can also add your own component specific attributes.
Attribute names need to be unique. If two events need the same attribute, define this attribute at the global level or the category level.
Attributes have the following properties
If there are attributes that your component will not be using, you can mark them as "unused" by unchecking the Use checkbox. Required attributes cannot be marked as unused. Also you can mark attributes unused at the global, category or event levels, with the higher levels overriding the lower ones, i.e. if an attribute is marked unused at the global level, it cannot be used at the category or event levels.
There are three levels - Exceptional, Basic and Enhanced
A level is just a collection of filters. E.g. In the Basic level, all authentication events are turned on, but authorization events are not.
Any event turned on at a lower level is automatically inherited by the higher level, unless overriden. E.g. since the basic level turns on all authentication events, the enhanced level also has them turned on.
You can override these levels, but you cannot add new ones. When you are override a level, you can choose to inherit some settings from the generic level. So in the future if the generic level changes, you will inherit the changes.
The levels that you define will only be applicable to the events that your component uses/extends/creates. So in the level definition table, you will only see those events that are used by your components. For each level-event combination you can specify whether
While entering the criteria for a level, if you want two separate criteria - one when status is success and the other when status is failure, enter the criteria in the following form:
(EventStatus -eq true -and (...)) -or (EventStatus -eq false -and (...))
Entering the criteria is this form will enable the EM GUI to break up the criteria into two separate criteria while showing the definition of the level in the GUI.