Page 66 of 82
Copyright (c) 2010 RICOH COMPANY, LTD. All Rights Reserved.
7.1.1.1
Generation of Audit Logs
The TOE generates audit log entries whenever an auditable event occurs, and appends these to audit log
files. Audit logs consist of basic audit information and expanded audit information. Basic audit information
is data recorded when any kind of auditable event occurs. Expanded audit information is data recorded for
the generation of auditable events that require additional information for audit. Table 26 shows the audit
information for each auditable event.
If there is insufficient space in the audit log files to append new audit log files, older audit logs (identifiable
by their time and date details) are overwritten with newer audit logs.
Table 26: Auditable events and auditable information
Audit logs
Auditable events
Basic audit information
Expanded audit information
Starting Audit Function (*1)
-
Ending Audit Function (*1)
-
Login
-
Starting Lockout
Locked out user
Releasing Lockout
Locked out user who is to be
released
Release methods (auto Lockout
release/manual Lockout release)
Lockout release at TOE startup
(*2)
-
HDD encryption key generation
-
Successful storage of document
data
ID of object document data
Successful reading of document
data (*3)
ID of object document data
Successful deletion of
document data
ID of object document data
Receiving fax
-
Changing user password
(including new creation and
deletion)
The ID of the user in the event
of new
creation/changing/deletion of
another user's authentication
details
Deletion of administrator role
-
Addition of administrator role
-
Changing document data ACL
ID of object document data
Changing date and time of
system clock
-
Communication with trusted IT
product
- Date/time of event
- Types of event (auditable events
in this table)
- Subject identity (*4)
- Outcome
Communication IP address
