AUDIT Option Attributes

A query that uses the AUDIT option operates against the ec_event Event Collector database view, which stores information about events.

The following table describes the attributes that you can include in a filter expression in a query that uses the AUDIT option.

Note: When using the AUDIT option, you can use the getAttributes function to list all the attributes registered against Event Collector in the ec_event view. All attributes can be returned in a query. However, only attributes with the isFilterable attribute set to true can be used in a filter expression.
Attribute Description/Notes
applicationActivityInstanceId Unique identifier of the process activity associated with the event from the activity instance (runtime identifier).
applicationActivityModelId Unique identifier of the process activity associated with the event from the model (design time identifier).
applicationActivityName Name of the process activity associated with the event. For example:

gateway, StartEvent, ScriptTask, DBTask, gateway, Success, Failure.

applicationName Name of the application that generated the event.
attribute1 - attribute40 The 40 user-defined custom work item attribute fields associated with the event. For a description of these attributes, see Using Work Item Attribute Fields. Also see Sort Filter Criteria for the data type of each attribute.
caseReference Unique reference to a case object created by ActiveMatrix BPM.
caseSearchTag Unique identifier of case data.
channelId Unique identifier of the presentation channel associated with the event.
componentId Identifier of the component that generated the event.
contextId The contextID is used with the correlationID and parentContextID to determine the series of events that have occurred.

The contextID is set to a new value for each new service call made in a chain of events - thus identifying the contents of a specific service call.

correlationId CorrelationID of the event.

The correlationID is used with the contextID and parentContextID to determine the series of events that have occurred.

The correlationID is set when a service request is received from an external source. It remains the same for the duration of that request (including any child service calls made).

creationTime Timestamp that the event occurred.
entityId Identifier of the organization model entity associated with the event.
entityType Type of the organization model entity associated with the event. This must be one of the following values:
  • ORGANIZATION
  • ORGANIZATIONAL_UNIT
  • GROUP
  • POSITION
  • PRIVILEGE
  • CAPABILITY
  • RESOURCE
  • LOCATION
  • ORGANIZATION_TYPE
  • ORGANIZATIONAL_UNIT_TYPE
  • POSITION_TYPE
  • LOCATION_TYPE
  • ORGUNIT_RELATIONSHIP_TYPE
  • POSITION_HELD
  • ORGUNIT_RELATIONSHIP
  • ORGUNIT_FEATURE
  • POSITION_FEATURE
  • PARAMETER_DESCRIPTOR
environmentId The reference to the ec_environment table.
extendedMessage Extended message for the message. This will generally contain more information, for example, the reason for a failed activity.
hostAddress Address of the host on which the event occurred.
hostName Name of the host on which the event occurred.
id Primary key of the event.
managedObjectId Valid values for this attribute depend on the value of the messageCategory attribute - see Message Categories and Attribute Contents.
managedObjectName Valid values for this attribute depend on the value of the messageCategory attribute - see Message Categories and Attribute Contents.
managedObjectType Valid values for this attribute depend on the value of the messageCategory attribute - see Message Categories and Attribute Contents.
managedObjectStatus The status of the managed object. This is only applicable to the WORK_ITEM message category.
managedObjectUrl Valid values for this attribute depend on the value of the messageCategory attribute. See Message Categories and Attribute Contents.
managedObjectVersion Valid values for this attribute depend on the value of the messageCategory attribute - see Message Categories and Attribute Contents.
message Description of the event.
messageCategory Identifies the entity which was being operated on causing this event to be produced. See Message Categories and Attribute Contents.
messageId Identifier of the event. For example: 
   messageId='BX_INSTANCE_PROCESS*'
modelMajorVersion Major version number of a case data model.
modelVersion Version number of a case model.
moduleName Process package name of the deployed process associated with the event.
nodeName Name of the node on which the event occurred.
parentActivityInstanceId Identifier of the parent activity associated with the event.
parentContextId The parentContextID is used with the correlationID and contextID to determine the series of events that have occurred.

The parentContextID is set to a new value each time an internal (to a component) service call is made, and is set to the contextID of the calling service, thus identifying the parent of this service call.

parentObjectId Valid values for this attribute depend on the value of the messageCategory attribute - see Message Categories and Attribute Contents.
parentProcessInstanceId Identifier of the parent process associated with the event.
principalId Unique identifier of the security principal associated with the event.
principalName Name of the security principal associated with the event.
priority Priority of the event. This must be one of the following:
  • LOW
  • MEDIUM
  • HIGH
priorStepId Identifier of the previous activity (to the one associated with the event).
processPriority Priority of the process instance associated with the event.
resourceId Identifier of the resource associated with the event.
resourceName Name of the resource associated with the event.
roleName The rolename given to a link between two case data classes.
severity Severity of the event. This must be one of the following:
  • TRACE
  • DEBUG
  • INFO
  • SERVICE
  • AUDIT
  • WARN
  • ERROR
  • FATAL
subprocessInstanceId Identifier of the sub-process associated with the event.
subprocessName Name of the sub-process associated with the event.
subprocessVersion Version of the sub-process associated with the event.
systemActionComponentId Identifier of the component that requested a system action check. (Typically this will be BRM.)
systemActionId Unique identifier of the requested system action.
retryTime The time when the failed activity will be retried again.
workItemPriority The priority of the work item.
workItemScheduleEnd Scheduled end date of the work item associated with the event.
workItemScheduleStart Scheduled start date of the work item associated with the event.