Hsi.transactionxlog action/subaction num questions

[Jonna_Pantelis]

I've created a SQL query for reporting user logins using hsi.useraccount and hsi.transactionxlog tables, and have most everything figured out except for the following questions:

1. In the Database Reporting Guide, it states that actionnum = 1 and subactionnum = 3 is "Logged into Print Server" (what does that mean? I show many user with this action combo)
2. The Reporting Database Guide does not have a definition for actionum =1 and subactionum = 13, can someone please explain what that is, as I show many users with that combo as well.

Thanks!

[Joel_Moore1]

Hi Jonna,

The section you're looking at in the Database Reporting Guide relates to the hsi.securitylog table, and not the hsi.transactionxlog table. Please correct me if I am wrong, but I am under the impression you are hoping to define these combinations for the transactionxlog table.

Here's what the combinations you provided translate to in the context of the transactionxlog table:

actionnum = 1, subactionnum = 3 -> User Deleted the Document

actionnum = 1, subactionnum = 13 -> User viewed the Document in Document Separation

If you ever encounter a combination you are not familiar with, the 'tmessage' column in the transactionxlog table generally provides enough context to get an idea of what is going on.

Please let me know if you have any questions!

Best,

Joel

[Jonna_Pantelis]

Ooops Joel, sorry! I mis-typed the table names, I actually meant the hsi.securitylog table not the transactionxlog table.

[Joel_Moore1]

Hi Jonna,

Here's what these events translate to in the context of the hsi.securitylog table:

actionnum = 1, subactionnum = 3 -> A Thick Client Executable configured with the -PS Command Line Switch has authenticated

actionnum = 1, subactionnum = 13 -> A User has authenticated with the ActiveX Web Client

Here is a little more information about the -PS Switch per the Command Line Switches MRG:

-PS activates the client Print Server mode. When a client is in print server mode, it monitors all

network print queues assigned in the workstation options for rendering jobs (printing and

archiving).

Once the print server detects a new rendering job, it marks the job as In Progress in order to

avoid another print server, serving the same network print queue, from rendering the same job.

This implies that a print server can serve many network print queues and a network print queue

can be served by many print servers.

-Joel