File System Audit Log Effects Codes
Codes are provided in the audit logs that identify actions by the policy enforcement engine. The code follows the number of the rule being processed.
| Code | Definition |
|---|---|
| A | The Action component of a security rule failed to match. |
| M | All security rule components match and, unless overridden, the Effect for that security rule is applied. |
| P | The Process component of a security rule failed to match. |
| R | The Resource component of a security rule failed to match. |
| T | The time specified in the When component of a security rule failed to match. |
| U | The User component of a security rule failed to match. |
Refer to the audit log example above:
-
The first and second Security Rules fail because of a mismatch in the User component (1U, 2U).
-
The third Security Rule fails because of a Resource component (3R) mismatch.
-
All of the rules in the fourth Security Rule match (4M), and the actions defined in the policy, such as use an encryption key, are applied.
