This message describes the event of a system, such as a mobile device, intentionally entering or leaving the network.
Note: The machine should attempt to send this message prior to detaching. If this is not possible, it should retain the message in a local buffer so that it can be sent later. The mobile machine can then capture audit messages in a local buffer while it is outside the secure domain. When it is reconnected to the secure domain, it can send the detach message (if buffered), followed by the buffered messages, followed by a mobile machine message for rejoining the secure domain. The timestamps on these messages is the time that the event was noticed to have occurred, not the time that the message is sent.
Table A.5.3.9-1 Audit Message for Network Entry
|Real World Entities||Field Name||Opt.||Value|
|Event||EventID||M||EV (110108, DCM, ”Network Entry”)|
|EventActionCode||M||Shall be: E = Execute|
|EventTypeCode||M||EV (110124, DCM, “Attach”) EV (110125, DCM, “Detach”)|
|Active Participant: Node or System entering or leaving the network (1)||UserID||M||not specialized|
|UserIsRequestor||M||Shall be FALSE|
No Participant Objects are needed for this message.