Maintaining Filter Definitions

#### Search Results

Search

# Maintaining Filter Definitions

An Audit Filter definition specifies filter conditions for auditing, based on the values of fields in the database records, request information, or client information. No Filter definitions are required. Filter definitions are defined using Adabas Auditing Configuration.

This section describes the following topics:

- Listing Filter Definitions

- Adding Filter Definitions

- Modifying Filter Definitions

- Copying Filter Definitions

- Deleting Filter Definitions

- Rules for Writing Filter Conditions

## Listing Filter Definitions

To use the Adabas Auditing Configuration to list the Filter definitions stored in the Auditing system file, complete the following steps:

- Select option F from the Adabas Auditing Configuration Main Menu.

  The List of Filters screen appears showing all the Filter definitions in the Adabas Auditing Configuration.

      18:28:56        ***** A D A B A S  AUDITING CONFIGURATION *****     2020-02-28
                                    List of Filters                       M-RP1140

       Sel  Name                               ID
       ---  --------------------------------   --------
        _   PAYROLL_APPLICATION_FILTER         PAYRFILT

      Command ==>
      Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
            Help  Repos Exit  Add         ID     -     +                      Menu

  The following tables describe the options on this menu.

  Sel | Allows you to:
  --- | ---
  M | Modify an Audit Filter definition
  C | Copy an Audit Filter definition
  D | Delete an Audit Filter definition
  PF Key | Allows you to:
  PF1 | Get screen help
  PF2 | Reposition to a specific Audit Filter definition in the list
  PF3 | Exit this screen and return to the previous screen
  PF4 | Add a new Audit Filter definition
  PF6 | Toggle between the sorting of Filters by ID or Name
  PF12 | Exit this screen and return to the main menu

## Adding Filter Definitions

To use the Adabas Auditing Configuration to add an Audit Filter definition to the Auditing system file, complete the following steps:

- Step 1. Access the Filter Definition Area of the Adabas Auditing Configuration

- Step 2. Specify a Filter Definition ID and Name

- Step 3. Add Filter Conditions to the Filter Definition

- Step 4. Save the Filter Definition

### Step 1. Access the Filter Definition Area of the Adabas Auditing Configuration

To access the Filter Definition area of the Adabas Auditing Configuration, complete the following steps:

1. Select F from the Adabas Auditing Configuration main menu to list the Filter definitions, as described earlier in Listing Filter Definitions.

2. Press PF4 (Add).

   The Filter Definition screen appears.

       18:30:29      ***** A D A B A S  AUDITING CONFIGURATION *****        2020-02-28
                                   Filter Definition                        M-RP1150

       Filter Name ... ________________________________                     1 of 1
       Filter ID ..... ________  Exclude or Include Records .. I

                 ------  Source  --------------------            -----  Target  -----
       Sel Group Field   PE    MU Image  Begin Length    Cond    Field Value
       --- ----- ------------------------------------    ----    --------------------

       Command ==>
       Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
             Help        Exit  Add   Save        -     +                       Menu

### Step 2. Specify a Filter Definition ID and Name

To specify a Filter definition ID and Name:

1. Tab to the Filter ID field and specify a unique name for the Filter definition. The name must use alphanumeric characters and be between one and 32 characters long. Embedded spaces are automatically changed to underscores.

2. Tab to the Filter ID field and specify a unique ID for the Filter definition. The ID must use alphanumeric characters and be between 1 and 8 characters long.

3. Tab to the Exclude or Include Records field and specify an "I" to include (audit) the records selected by the filter definition or an "E" to exclude (do not audit) records selected by the filter definition.

4. Although no field filter conditions have yet been specified for the Filter definition, press PF5 to save it.

### Step 3. Add Filter Conditions to the Filter Definition

For more information about rules of filter conditions, refer to the section Rules for Writing Filter Conditions.

To add filter conditions to the Filter definition:

1. Press PF4 (Add) to define field filter conditions for the Filter definition. Up to 2500 filter conditions can be specified.

   The Filter Condition screen appears with the Filter ID listed at the top of the screen.

       18:31:16        ***** A D A B A S  AUDITING CONFIGURATION *****      2020-02-28
                                      Filter Condition                      M-RP1155

       Filter Name ... SALARY_FILE_FILTER                Filter ID .... SLRYFILT
               -------  Source  ------           -------  Target  ------
         Group Field   PE    MU  Image Condition Field   PE    MU  Image
          2nd line:  Begin Length                      Begin Length
         ----- ----------------------- --------- -----------------------
          ___   __   _____ _____  __       __     __   _____ _____  __    or value(s)
                     _____ _____                       _____ _____
       Target Value 1   ..
       ____________________________________________________________________________
       ____________________________________________________________________________
       ____________________________________________________________________________
       ____________________________________________________________________________
       Target Value 2   ..
       ____________________________________________________________________________
       ____________________________________________________________________________
       ____________________________________________________________________________
       ____________________________________________________________________________
       Command ==>

       Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
             Help        Exit        Save        -     +                       Menu

   Note that you can specify a target field, part of a target field, or multiple target values on this screen:

   - The target field is specified under the Target heading in the Field column.

   - The part of a target field is specified under the Target heading using a combination of the Field column and the Begin and Length columns (which are on the second line).

   - Multiple target values can be specified in the Target Value n fields at the bottom part of the screen.

2. Update the fields on this screen as described in the following table.

   Note
   The Filter definition ID cannot be changed.

   Field ID | Description | Default
   --- | --- | ---
   Group | You can use a group number to group field filters together within an Audit Filter definition. All field filters with the same group number are blocked and logically ANDed together when the filters are examined during subscription processing. In other words, a field in the database must meet all the criteria of the group before it is selected. Likewise, different groups of field filters are logically ORed together. In other words, a field need only meet the criteria specified by one of the groups to be selected. Valid values are numbers ranging from 1 through 999. | -
   Source Field | The two-byte Adabas field code for the field to be compared. The Source Field must be in the format buffer specified for the item type. If you want to specify part of a Source Field for the comparison, specify: a starting byte number in the Source Begin field on the second line. optionally, the length of the part to be compared in the Source Length field on the second line. Note The format of the complete field is used for partial field comparisons. If the formats of a Source Field or partial Source Field and a Target Field or partial Target Field do not match, the comparisons may always result in an unequal condition. For example, comparing an alphanumeric field to a packed field will always result in an unequal condition. | -
   Source PE | The index number (occurrence) of the periodic group (PE) to which the condition relates if the Source Field in this field filter is a PE field. Valid values range from 0 through 191. | 0, indicating the Source Field is not a PE field.
   Source MU | The index number of the multiple-value field (MU) to which the condition relates if the Source Field in this field filter is an MU field. Valid values range from 0 through 191. | 0, indicating the Source Field is not an MU field.
   Source Image | Whether the Source Field is in the after image (AI), before image (BI), or the default image of the record Valid values are "AI" and "BI". Note The Source Image field should only be specified for update commands. | AI for selects, inserts and updates BI for deletes
   Source Begin | The starting byte number of the partial Source Field to be compared. The Source Begin field is only used if you want to specify a partial Source Field for comparison and only if the Source Field is of alphanumeric or binary format. Note The format of the complete field is used for partial field comparisons. Valid comparisons of different field types are listed in Field Type Considerations. For fixed length fields, valid values range from "1" (the start of the field) through the maximum length of the field (the last byte of the field). For variable length fields, valid values range from "1" (the start of the field) to the maximum length allowed for that field type. Counting occurs from left to right beginning with 1 for fields defined with alphanumeric format, and from right to left beginning with 1 for fields defined with binary format. | 1
   Source Length | The numeric length of the partial Source Field that should be compared. The Source Length field is only used if you want to specify a partial Source Field for comparison and only if the Source Field is of alphanumeric or binary format. Note The format of the complete field is used for partial field comparisons. Valid comparisons of different field types are listed in Field Type Considerations. For fixed length fields, errors will occur if the sum of the values of the Source Begin and Source Length parameters exceeds the fixed length of the field. For variable length fields, the sum of the values of the Source Begin and Source Length parameters must not exceed the maximum length of the field plus 1. For example, if a variable length field has format "A" with a maximum length of 253 bytes, settings of Source Begin=1 and Source Length=253 are valid, but settings of Source Begin=2 and Source Length=254 are not. | If Source Begin is not specified, the default value is the entire field. If Source Begin is specified, the default value is the maximum length of the field minus the value of the Source Begin parameter plus 1.
   Condition | A condition operator code for the filter. Valid values are "EQ" (equal to), "NE" (not equal to), "LT" (less than), "LE" (less than or equal to), "GT" (greater than), or "GE" (greater than or equal to). When EQ or NE are specified, multiple target values and target values using wildcards can be tested. For all other condition codes, only single target values without wildcards can be tested. | EQ
   Target Field | The two-byte Adabas field code for the field with which the Source Field will be compared. Use single quotation marks around the field code. The Target Field must be in the same record as the Source Field. If you want to specify part of a Target Field for the comparison, specify: a starting byte number in the Target Begin field on the second line. optionally, the length of the part to be compared in the Target Length field on the second line. Notes: A Target Field cannot be used for Request or Client filters. Only Target values may be specified for Request and Client filters. The format of the complete field is used for partial field comparisons. Valid comparisons of different field types are listed in Field Type Considerations. Target Field is mutually exclusive with the Target Value n fields. If you specify a Target Field, you cannot specify values in the Target Value n fields. | -
   Target PE | The index number of the periodic group (PE) to which the condition relates if the Target Field in this field filter is a PE field. Valid values range from 0 through 191. The Target PE field is mutually exclusive with the Target Value n fields. If you specify a Target Field, you cannot specify values in the Target Value n fields. | 0, indicating the Target Field is not a PE field.
   Target MU | The index number (occurrence) of the multiple-value field (MU) to which the condition relates if the Target Field in this field filter is an MU field. Valid values range from 0 through 191. The Target MU field is mutually exclusive with the Target Value n fields. If you specify a Target Field, you cannot specify values in the Target Value n fields. | 0, indicating the Target Field is not an MU field.
   Target Image | Whether the Target Field is in the after image (AI), before image (BI), or the default image of the record. Valid values are "AI" and "BI". The Target Image field is mutually exclusive with the Target Value n fields. If you specify a Target Field, you cannot specify values in the Target Value n fields. Note The Target Image field should only be specified for update commands. | AI for selects, inserts, and updates. BI for deletes.
   Target Begin | The starting byte number of the partial Target Field at which the comparison should begin. This field should only be specified if you want to specify a partial field for comparison, if the field is of alphanumeric or binary format, and only if a Target Field is specified. Note The format of the complete field is used for partial field comparisons. Valid comparisons of different field types are listed in Field Type Considerations. For fixed length fields, valid values range from "1" (the start of the field) through the maximum length of the field (the last byte of the field). For variable length fields, valid values range from "1" (the start of the field) to the maximum length allowed for that field type. Counting occurs from left to right beginning with 1 for fields defined with alphanumeric format, and from right to left beginning with 1 for fields defined with binary format. | 1
   Target Length | The numeric length of the partial Target Field that should be used for the comparison. This field should only be specified if you want to specify a partial field for comparison, if the field is of alphanumeric or binary format, and only if a Target Field is specified. Note The format of the complete field is used for partial field comparisons. Valid comparisons of different field types are listed in Field Type Considerations. For fixed length fields, errors will occur if the sum of the values of the Target Begin and Target Length parameters exceeds the fixed length of the field. For variable length fields, the sum of the values of the Target Begin and Target Length parameters must not exceed the maximum length of the field plus 1. For example, if a variable length field has format "A" with a maximum length of 253 bytes, settings of Target Begin=1 and Target Length=253 are val-id, but settings of Target Begin=2 and Target Length=254 are not. | If Target Begin is not specified, the default value is the entire field. If Target Begin is specified, the default value is the maximum length of the field minus the value of the Target Begin parameter plus 1.
   Target Value n | A value against which the Source Field will be compared. Only one value can be specified in each Target Value n field. Up to 128 Target Value n fields are available in which you can specify values; use the PF7 and PF8 keys to scroll through them. Strings that include blanks should be enclosed in single quotes. Apostrophes in strings must be doubled (for example: ‘six o”clock’). A maximum of 254 characters can be specified for each value. Each value may consist of either free-format characters or a mix of elements specified using the A() or X() notation. If free-format data consists entirely of numeric data (including an optional leading "+" or "-" character) it is treated as a numeric value. If a value (or part of a value) is specified using A() notation, it will be treated as alphabetic data. Hexadecimal values may be specified using X() notation. A value must be specified entirely as free-format data, or composed of one or more A() or X() sub-elements. If a value begins with an A() or X() sub-element all remaining sub-elements of the value must be so specified. The Target Value n field is mutually exclusive with the Target Field, Target Image, Target MU, and Target PE fields. You cannot specify values for the Target Field, Target Image, Target MU, or Target PE fields if you have specified a value for the Target Value n field. | -

### Step 4. Save the Filter Definition

To save the Filter definition:

- Press PF5 to save the Filter definition in the Auditing system file.

## Modifying Filter Definitions

To use the Adabas Auditing Configuration to modify a Filter definition in the Auditing system file:

1. List the Filter definitions in the Adabas Auditing Configuration, as described earlier in Listing Filter Definitions.

2. Locate the definition you want to modify on the screen and enter an M in the Sel column for that definition.

   You can locate the definition you want in the list by pressing the PF7 (F7) or PF8 (F8) keys to scroll through the list. You can also press PF2 (F2) to specify the ID of the definition to which the list should be repositioned.

   An appropriate Filter definition screen appears for the Filter you selected.

3. Modify the Exclude or Include Record field, as necessary. If you want to modify a filter condition specification, enter an "M" next to it in the list to display and update the Filter Condition screen for that condition. If you want to delete a filter condition from the Filter definition, enter a "D" next to the condition in the list.

   Note
   You cannot alter the Name and ID of the Filter definition. If you want to rename a Filter definition, first copy it using the Name and ID you want and then delete the original.

   For information on modifying this screen, read the description of adding Filter definitions in Adding Filter Definitions.

4. When all modifications have been made, press PF5 to save the changes.

## Copying Filter Definitions

To use the Adabas Auditing Configuration to copy a Filter definition in the Auditing system file:

1. List the Filter definitions in the Adabas Auditing Configuration, as described in Listing Filter Definitions.

2. Locate the definition you want to copy on the screen and enter a C in the Sel column for that definition.

   You can locate the definition you want in the list by pressing the PF7 (F7) or PF8 (F8) keys to scroll through the list. You can also press PF2 (F2) to specify the ID of the definition to which the list should be repositioned.

   A dialog appears requesting an ID for the copy of the Filter definition.

        Enter new
        Name: ________________________________
          ID: ________
        or press PF3 to cancel

3. Specify new, unique Name and ID for the copy of the Filter definition and press Enter.

   The Filter definition is copied, and the copy appears on the List of Filters screen.

## Deleting Filter Definitions

To use the Adabas Auditing Configuration to delete a Filter definition in the Auditing system file:

1. List the Filter definitions in the Adabas Auditing Configuration, as described in Listing Filter Definitions.

2. Locate the definition you want to delete on the screen and enter a D in the Sel column for that definition and press Enter. The Filter definition is deleted.

   You can locate the definition you want in the list by pressing the PF7 (F7) or PF8 (F8) keys to scroll through the list. You can also press PF2 (F2) to specify the ID of the definition to which the list should be repositioned.

   Note
   If you want to delete a filter condition from the Filter definition, read Modifying Filter Definitions.

## Rules for Writing Filter Conditions

There are various things you should consider when creating filter conditions. This section describes them.

- General Information

- So My Record Matches the Filter Conditions - Now What?

- Failed or Ignored Filter Conditions

- Target Value Syntax

- When You Can Specify Multiple Targets

- How Multiple Filter Conditions Are Interpreted

- Specifying a Range of Values

- Field Type Considerations

- Varying Field Length Considerations

- Using Wildcards

### General Information

A filter can operate on fields in the data record, request information, or client information. The type of data the filter operates on is determined by specifying the filter ID in the Data, Request, or Client filter ID fields on the File-related Parameters menu of the subscription.

For a data filter, the Source Field is in the data record, and the target for comparison may be another field in the data record (either Before or After image in the case of an update), or the target may be one or more values.

For a Request filter, the Source Field is in the request information, and the target is one or more values. The target cannot be another field.

For a Client filter, the Source Field is in the client information, and the target is one or more values. The target cannot be another field.

A subscription file can define a combination of Data, Request, and Client filters. If more than one filter is defined, all filters must meet acceptance criteria for the event to be audited.

### So My Record Matches the Filter Conditions - Now What?

Filter conditions are based on the values of fields (or partial fields) in a filter definition. If a field or partial field meets all the filter conditions specified, the record is selected. Once selected, the record will be either included or excluded from auditing processing, based on what the audit filter definition specifies. Therefore, selection of a record does not necessarily mean that it will be audited - merely that it passed the filter conditions specified by the audit filter definition. If the audit filter definition indicates that selected records should be excluded from auditing, the record will not be audited.

Audit filter definitions indicate whether selected records are audited or not via the Exclude or Include Record field on the Filter Definition screen of the Adabas Auditing Configuration.

Note
Include and exclude processing function in the same way for partial fields as for complete fields in your audit filters.

### Failed or Ignored Filter Conditions

A filter condition will be ignored if it cannot be evaluated. This can occur if the image to be tested is not present for auditing. The effect of this on filter processing varies, based on whether the filter occurs as part of include or exclude processing and, if it is included in a group of conditions, how the other conditions in the group are matched, failed, or ignored. This is best explained in a series of examples.

Examples:

1. Suppose an add command (N1) adds a record containing field AB to which the following filter is applied:

       Type of filter: INCLUDE
         Source Field: 'AB', Source Image: BI
           Condition: EQ
           Target Value: '1916'

   In this case, the filter cannot be evaluated because only the after image is present for an add and the filter is for the before image (Source-Image=BI). This filter is therefore ignored. No test is done on the field to see if the before image is equal to "1916". Consequently, the add record is not included in auditing processing.

2. Likewise, a similar exclude filter is also ignored:

       Type of filter: EXCLUDE
         Source Field: 'AB', Source Image: BI
           Condition: EQ
           Target Value: '1916'

   In this case, the filter cannot be evaluated because only the after image is present for an add and the filter is for the before image. This filter is therefore ignored, and no test is done on the field to see if the before image is equal to "1916". However, because this is an exclude filter, the add record is not excluded from auditing. In other words, it is included in auditing, regardless of whether the before image of the AB field was equal to "1916".

3. Now consider the following audit filter using multiple filter conditions and include processing:

       FILTER ID=MYINCLF
         Type of filter: INCLUDE
           Source Field: 'BA', Source Image: BI, Condition: EQ, Target Value: 'AAAA'
           Source Field: 'BB', Source Image: AI, Condition: EQ, Target Value: 'VVVV'
           Source Field: 'BC', Source Image: AI, Condition: EQ, Target Value: 'XXXX'

   If an add command (N1) is issued for a record containing the BA, BB, and BC fields, no before image is present for these fields - only the after image. Therefore, the filter condition for BA is ignored because the filter is for the before image. The BA filter condition is treated as if it is not even specified.

   The add record, then, is only included in auditing if both filters for fields BB and BC are true.

4. Finally, consider the following audit filter using multiple filter conditions, exclude processing, and OR processing:

       FILTER ID=MYEXCLF
         Type of filter: EXCLUDE
           Source Field: 'BA', Source Image: BI, Condition: EQ, Target Value: 'AAAA'
           Source Field: 'BB', Source Image: AI, Condition: EQ, Target Value: 'VVVV'
         OR
           Source Field: 'CA', Source Image: AI, Condition: EQ, Target Value: 'EEEE'
           Source Field: 'CB', Source Image: AI, Condition: EQ, Target Value: 'CCCC'
         OR
           Source Field: 'DA', Source Image: BI, Condition: EQ, Target Value: 'OOOO'
           Source Field: 'DB', Source Image: BI, Condition: EQ, Target Value: 'CCCC'

   If an add command (N1) is issued for a record containing these fields, no before image is pre-sent for these fields - only the after image. Therefore, the filter conditions for BA, DA, and DB are ignored because the filters are for the before image; these filter conditions are treated as if they are not even specified.

   The add record, then, is only excluded in auditing if the filter for BB is satisfied OR if both the filters for field CA and field CB are satisfied. Otherwise, the add record is included in auditing.

### Target Value Syntax

Target values are the values to be compared to the Source Field using the condition type specified (Include or Exclude).

Each value can be expressed in one of two ways:

- You can specify values as free-format text. This text can be any set of alphanumeric set of characters. If blanks are required in the value, you should enclose the value in single quotes.

  When the data in the text is all numeric with an optional leading "+" or "-" sign, it is flagged as a numeric value and will be handled differently depending on the Source Field type in the Adabas Audit Server definitions.

- You can specify values as a combination of "A()" and "X()" constructs that enable you to enter data for the same variable in alphabetic format, hexadecimal format, or both, as required. If the element value starts with the string "A(" or "X(" it is treated as an "A()" or "X()" value. If the value does not start with one of these strings, the value is treated as free-format text.

This section describes rules specific to these different methods of specifying target values.

- Free-Format Value Rules
- A() and X(0) Format Value Rule
- Source Field Data Type Rules
- Examples

#### Free-Format Value Rules

The following rules apply to free-format values.

- Free-format values can be any sequence of alphanumeric data apart from the comma character itself.

- If a blank is required for the free-format value, specify the value in single quotes.

- If an apostrophe is required as part of a free-format value, double the apostrophe (for example,‘six o”clock’).

- If the value consists of all numeric characters with an optional leading "+" or "-" sign, the value will be treated as numeric.

- If the value begins with a single asterisk (*), it is interpreted as a wildcard suffix (for example, '*xyz').

- If the value ends with a single asterisk, it is interpreted as a wildcard prefix (for example, 'abc*').

- If two asterisks are found together (**) in any location in the free-format value, they are interpreted as a single asterisk in the resulting data.

- If a single asterisk is found in the middle of the data, it is rejected as invalid.

Note
The asterisk wildcard can only be used if the condition for the filter expression is EQ (equal) or NE (not equal). They cannot be used for any other types of filter expression conditions.

#### A() and X(0) Format Value Rule

The following rules apply to A() and X() value specifications.

- The "A()" construct is specified using the following syntax:

      A(data)

  In this syntax, the data specified can be any alphanumeric characters, except the parentheses characters.

- The "X()" construct is specified using the following syntax:

      X(data)

  In this syntax, the data specified must be an even number of characters in the range X’F0’ to X’F9’ (i.e. 0 to 9) and X’C1’ to X’C6’ (i.e. A to F). Each pair of characters will represent the hexadecimal value for one byte in the resultant value.

- If a value starts with an "A()" or "X()" construct, the entire value must be specified using these constructs. You cannot mix them with free-format values.

- "A()" and "X()" constructs can be specified multiple times in the same value specification. They must always have matching opening and closing parentheses, or the entire value specification is treated as invalid.

- When the "A()" construct is used, the asterisk (*) wildcard character is treated in the same manner as for free-format values.

- When the "X()" construct is used, the X'5C' character (which represents an asterisk) is treated like any other hexadecimal character and is not interpreted as a wildcard.

#### Source Field Data Type Rules

The following rules apply to the specification of Target Values depending on the Source Field data type:

- Target Values for Source Fields with data type binary may be entered in hexadecimal.

- Target Values for Source Fields with data type floating point may be entered in hexadecimal.

- Target Values for Source Fields with data type unpacked, packed, and fixed may not be entered in hexadecimal.

#### Examples

In the following example, a Target Value of "ABCDE" is specified:

    ABCDE

In the following example, a numeric Target Value of "12345" is specified:

    12345

In the following example, a numeric Target Value of "-678" is specified:

    -678

In the following example, a Target Value of "AB123" is specified:

    AB123

In the following example, a Target Value of "XyZ" is specified:

    A(XyZ)

In the following example, a Target Value of "SSS" (the alphabetic equivalent of X'E2E2E2') is specified:

    X(E2E2E2)

In the following example, a Target Value of "*abc*" ("abc" is the alphabetic equivalent of X'C1C2C3') is specified. Note that this value is open-ended because wildcards are specified:

    A(*)X(C1C2C3)A(*)

In the following example, a Target Value of "*def**" is specified. Note that the first asterisk specifies a wildcard, but the last two asterisks specify asterisk characters (the alphabetic equivalent of X'5C5C'):

    A(*def)X(5C5C)

The following Target Value examples are invalid because they specify a wildcard asterisk in the middle of the values:

    *ABC*DEF*
    X(F5F6)*X(F7F8)
    X(F2)A(*)X(F4)

The following Target Value examples are invalid because they specify invalid hexadecimal data:

    X(ABACFGZZAE)
    X(ABC)

The following Target Value example is invalid because it mixes free-format and hexadecimal data:

    X(AB)AB

The following Target Value example is invalid because it misuses commas

    X(ABAC),,A(123)

The following Target Value example is invalid because it misuses parentheses in the A() construct:

    A(12(34))

### When You Can Specify Multiple Targets

You can only specify multiple targets if the condition operator is EQ (equal) or NE (not equal). The LT (less than), LE (less than or equal), GT (greater than), and GE (greater than or equal) operators logically assume a comparison of the Source Field value to a single Target Value, so multiple Target Values are not allowed for these condition operators.

Since wildcards are essentially a concise way of specifying multiple targets, you can also only use wildcards when the condition operator is EQ or NE.

If your filter checks to see if the Source Field value is equal to a list of Target Values, the Source Field value need only be equivalent to one of the Target Values for the filter condition to be true. On the other hand, if your filter checks to see if the Source Field value is not equal to a list of Target Values, the Source Field value must not be equal to any of the Target Values for the filter condition to be true.

Examples:

In the following example, records for which the after image of the AA field is equal to "1", "2", "3", or "4" are selected.

    Type of filter: Include
    Source Field: ’AA’, Source Image: AI, Condition: EQ, Target Values: 1, 2, 3, 4

In the following example, records for which the after image of the AA field is greater than "5" are selected.

    Type of filter: INCLUDE
    Source Field: ’AA’, Source Image: AI, Condition: GT, Target Value: 5

In the following example, records for which the first three bytes of the after image of the BB field contain the characters "abc" are selected.

    Type of filter: INCLUDE
    Source Field: ’BB’, Source Image: AI, Condition: EQ, Target Value: abc*

In the following example, records for which the last three bytes of the after image of the BB field contain the characters "xyz" are selected.

    Type of filter: INCLUDE
    Source Field: ’BB’, Source Image: AI, Condition: EQ, Target Value: *xyz

In the following example, records in which no bytes of the after image of the BB field contain the characters "klm" are selected.

    Type of filter: INCLUDE
    Source Field: ’BB’, Source Image: AI, Condition: NE, Target Value: *klm*

The following example is invalid because it specifies multiple Target Values when the condition code is not EQ or NE.

    Type of filter: INCLUDE
    Source Field : ’AA’, Source Image : AI, Condition : LE, Target Values : 1, 2, 3, 4

The following example is invalid because it specifies a wildcard in the Target Values when the condition code is not EQ or NE.

    Type of filter: INCLUDE
    Source Field: ’AA’, Source Image: AI, Condition: GT, Target Value: *xyz

### How Multiple Filter Conditions Are Interpreted

You can specify multiple filter conditions within a single audit filter definition. Using the Group field on the Filter Condition screen of the Adabas Auditing Configuration to define your audit filter definitions, use the same group number for those conditions you want ANDed.

Conditions with different Group numbers are logically ORed.

For conditions that are ANDed (have the same Group number), all conditions in that group must be true for the group condition to be true.

For conditions that are ORed (have different Group numbers), any one of the conditions of the group must be true for the filter to be true.

### Specifying a Range of Values

You can specify a range of values in your filter condition by creating two conditions that are logically ANDed (see How Multiple Filter Conditions Are Interpreted). Simply define one filter condition to test for values greater than (GT) or greater than or equal to (GE) the lowermost value. Then define the second filter condition to test for values less than (LT) or less than or equal to (LE) the uppermost value. As both conditions must be true since they are logically ANDed, your range specification is assured.

### Field Type Considerations

Ideally, when a Source Field is compared to a Target Field, the field types will be the same. However, it is possible to compare fields of different formats. For example, you can compare a packed decimal format Source Field with a binary format Target Field. For a complete list of compatible Adabas field types, refer to your Adabas documentation.

This section covers the following topics related to how fields of different formats are compared:

- Valid Comparison Table
- Source Field Value vs Target Field Value Comparison Processing by Field Type
- Source Field Value vs Target Values Comparison Processing by Field Type

#### Valid Comparison Table

An asterisk (*) in a cell in the following table indicates that a comparison of the field types is valid. A blank in a cell in the table indicates that a comparison is not supported.

Field Data Type | Alphanumeric | Unpacked | Packed | Binary | Floating Point | Wide-Character | Fixed Point
--- | --- | --- | --- | --- | --- | --- | ---
Alphanumeric | * |  |  | * |  | * |
Unpacked |  | * | * | * | * |  | *
Packed |  | * | * | * | * |  | *
Binary | * | * | * | * | * |  | *
Floating Point |  | * | * | * | * |  | *
Wide-Character | * |  |  |  |  | * |
Fixed Point |  | * | * | * | * |  | *

#### Source Field Value vs Target Field Value Comparison Processing by Field Type

The following table lists the conversions that apply when comparing Source Field values with Target Field values:

Source Field Data Type | Target Field Data Type | Comparison Conversion Notes
--- | --- | ---
Unpacked | Unpacked | The Source Field value and Target Field value are converted to packed form for comparison.
Binary | Packed | The Target Field value is converted to binary for comparison.
| Unpacked | The Target Field value is converted to binary for comparison.
| Alphanumeric | The Source Field value and Target Field value are compared as is.
Packed | Packed | The Source Field value and Target Field value are compared as is.
| Unpacked | The Target Field value is converted to packed for comparison.
| Binary | The Target Field value is converted to packed for comparison.
| Fixed | The Target Field value is converted to packed for comparison.
Fixed | Packed | The Source Field value is converted to packed for comparison.
| Unpacked | The Source Field value and Target Field value are converted to packed form for comparison.
| Binary | The Source Field value is converted to binary for comparison.
| Fixed | The Source Field value and Target Field value are compared as is.

Notes:

1. When either the Source Field or Target Field is of type floating-point (but not both fields), the other field will be converted to floating point, and a floating-point comparison will be made.
2. The conversion of very large numbers in a numeric format other than floating point to floating may result in a loss of precision because as the numbers get bigger, the range of numbers that may be represented in the floating point format is reduced. For example, the value 99,999,999,999,999,999 will be converted to the floating-point value 99,999,999,999,999,984.

#### Source Field Value vs Target Values Comparison Processing by Field Type

The following table lists the conversions that apply when comparing Source Field values with Target Values:

Source Field Data Type | Target Value Data Type | Comparison Conversion Notes
--- | --- | ---
Any | Any | The Target Value(s) are converted to the data type of the Source Field for comparison.

Note
The conversion of Target Value(s) to the data type of the Source Field can cause problems in the accuracy of filter condition processing if a Target Value in the list cannot be converted or is otherwise incompatible with the required Source Field type.

### Varying Field Length Considerations

When the length of the Source Field and Target Field are different, the shorter value is converted to the size of the longer value. For alphanumeric data, the value is padded on the right with blanks. For numeric data, the value is padded on the left with hexadecimal zeros.

### Using Wildcards

You can use an asterisk (*) as a wildcard for Target Values if the condition code being used is EQ (equal) or NE (not equal). You cannot use wildcard characters for any other filter conditions (GT, LT, LE, or GE).

#### Note:

Wildcard values are not supported for wide character fields.

- If you want to test the Source Field value for any Target Value beginning with a specific string of characters, simply append an asterisk to the end of the Target Value. For example, to test for a Source Field value starting with the characters "POW", specify "POW*" as the Target Value.

- If you want to test the Source Field value for the presence of a specific string within its value, precede and supersede the string with an asterisk. For example, to test for the presence of the string "WER", specify "*WER*" as the Target Value.

- If you need to test for the presence of an asterisk itself in a Source Field value, specify two asterisks in a row for the Target Value ("**").

### On this page

- Listing Filter Definitions
- Adding Filter Definitions
- Modifying Filter Definitions
- Copying Filter Definitions
- Deleting Filter Definitions
- Rules for Writing Filter Conditions