If logging of audit events and modified settings is enabled in Event Log settings, when a dictionary is created, edited, or deleted in the Rules → Dictionaries section, detailed information about the changes is recorded in an Audit Log event.
Changes in the Dictionary usage group of settings are not logged.
The following table shows how dictionary settings are coded in an Audit Log record.
Codes of dictionary settings in an audit event record
Setting in the Rules → Dictionaries section |
Code in the audit event record |
Examples |
|---|---|---|
Dictionary ID |
Changes of the setting are only logged when a dictionary is created or deleted. |
Dictionary created:
Dictionary modified:
Dictionary deleted:
|
Name |
|
|
Description |
|
|
Dictionary contents |
Possible values:
|
|
Text |
After creating a dictionary with string content type, the audit log record will also contain lines for the Search types setting of the following form:
If a data category has a subcategory, the record contains For category, subcategory, and file type codes, see Dictionary category and file type codes in audit events. |
Dictionary created:
Dictionary modified:
Dictionary deleted:
|
Wildcard |
After creating a dictionary with string content type, the audit log record will also contain lines for the Search types setting of the following form:
|
Dictionary created:
Dictionary modified:
Dictionary deleted:
|
Regexp |
After creating a dictionary with string content type, the event record will also contain records for the Search types setting of the following form:
|
Dictionary created:
Dictionary modified:
Dictionary deleted:
|
Search types |
When creating or deleting a dictionary, a line of the following form is logged for each file type:
When modifying the dictionary, for file types whose check box state has changed, a line of the following form is logged:
After creating a dictionary with File types content type, the log also includes records for the Text, Wildcard, Regexp settings of the following form:
|
The dictionary is created for the following file types: 7Z*; ACE; ARJ; EXE; DLL; OCX; SCR; SWF.
Lines are also added for all file types that were not selected:
Dictionary modified:
No records are added for other file types because the other file types are unchanged. Dictionary deleted:
For all other file types, records like this are logged:
|