FUJ00176543 - Fujitsu Services Audit Data Extraction Process from Neneh Lowther - Version 2.1 - - Draft
Fujitsu Services
Audit Data Extraction Process
Company-in-Confidence
Ref:
Version:
Date:
FUJ00176543
FUJ00176543
IA/PRO/004
2A
26/10/2004
Document Title:
Document Type:
Abstract:
Document Status:
Originator & Dept:
Contributors:
Internal Distribution:
External Distribution:
Approval Authorities:
Audit Data Extraction Process
Process
This document establishes the process undertaken by Post Office
Account CS Security Prosecution Support Section to locate,
retrieve, extract, filter and prepare audit data for despatch to
authorised requesters
DRAFT
Neneh Lowther - Customer Service Security
Jan Holmes / Penny Thomas/Bill Mitchell
Jan Holmes/Bill Mitchell
Jamie Henderson (POLIA) and Graham Ward (POL SI)
(See PA/PRO/010 for Approval roles)
Name Position Signature Date
Jan Holmes Programme Assurance
Manager
Bill Mitchell Customer Service Security
Manager
Dave Baldwin Customer Service Director
Company-in-Confidence Page: 1 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176543
FUJ00176543
Fujitsu Services Audit Data Extraction Process Ref: IA/PRO/004
Version: 2.1
Company-in-Confidence Date: 26/10/2004
0.0 Document Control
0.1. Document History
Version No. I Date Reason for Issue Associated
CP/Peak
01 01/01/02 Initial draft based on CSR+ version [A/PRO/003
0.2 15/04/02 Addition of comments and change to Fujitsu Services
1.0 29/05/02 Approved
Ll 17/01/03 Update to BI3 system and contractual changes
2.0 27/01/03 Approved
2.1 26/10/04 Addition of comments and change to internal
processes
0.2 Review Details
Review Comments by: I Date 08/11/04
Review Comments to: I Originator
Mandatory Review Authority Name
Programme Assurance Manager Jan Holmes
Customer Service Security Manager Bill Mitchell
IPDU Audit Alan Holmes
IPDU Audit Brian Muir/Oddette Moronfolu
Optional Review / Issued for Information
(*) = Reviewers that returned comments
0.3. Associated Documents
Reference Version I Date Title Source
PA/TEM/001 8.0 19/12/02 Fujitsu Services Document PVCS
Template
TA/MAN/005 Horizon System Audit Manual
TA/SPE/008 Audit Data Catalogue
Company-in-Confidence Page: 2 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
Fujitsu Services
Audit Data Extraction Process Ref: 1A/PRO/004
Version: 2.1
Company-in-Confidence Date: 26/10/2004
FUJ00176543
FUJ00176543
IA/SPE/018 Audit Data Catalogue - ADC
(Consignia SIS)
IA/SPE/019 Audit Data Catalogue
(Consignia AP Clients)
TA/SPE/020 Audit Data Catalogue (System
Management
1A/SPE/021 Audit Data Catalogue (System
Management)
TA/SPE/021 Audit Data Catalogue (Internal
Audit)
RS/MAN/010 SecureID Normal Token User
Guide
NB/MAN/002 PSS Database Manual
CS/SER/016 Service Description for
Security Service Management
Unless a specific version is referred to above, reference should be made to the current
approved versions of the documents.
0.4 Abbreviations/Definitions
Abbreviation Definition
ARQ Audit Record Query
AS Audit Server
AW Audit Workstation
CD-W Writeable CD
OBCS Order Book Control System
PIN Personal Identification Number
Peak Problem Management System operated by Fujitsu Services
POLIA Post Office Limited, Internal Audit
PSS Prosecution Support Section
RFI Request For Information (RFI is synonymous with ARQ.)
TMS Transaction Management System
0.5 Changes in this Version
Company-in-Confidence Page: 3 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176543
FUJ00176543
Fujitsu Services Audit Data Extraction Process Ref: IA/PRO/004
Version: 2.1
Company-in-Confidence Date: 26/10/2004
Version Changes
2.1 Addition of comments, change to internal processes and systems and
change to POIA contact details
0.6 Changes Expected
Changes
Company-in-Confidence Page: 4 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176543
FUJ00176543
Fujitsu Services Audit Data Extraction Process Ref: TA/PRO/004
Version: 2.1
Company-in-Confidence Date: 26/10/2004
Table of Contents
1.0 INTRODUCTION
2.0 SCOPE.
3.0 TERMINOLOGY.
4.0 AUDIT DATA INTEGRITY.
41 RETRIEVAL SCHEMATIC.
5.0 OVERVIEW.
5.1 AUDIT RECORD QUERY..
5.2. MARKING FILES AND TAPE
5.3. AUDIT TRACK RETRIEVER.
POLLS THE USER AREA BUFFERS AND MAKES THEM AVAILABLE TO SEALER FOR SEAL,
VERIFICATIONAUDIT DATA CHECK SEAL.
AubIt DATA CHECK SEAL..
5.4 AUDIT TRAIL EXTRACTOR.
6.0 RETRIEVING & EXTRACTING AUDIT DATA.
6.1 RECEIVING THE ARQ
6.2 INTERPRETING THE ARQ.
6.3 LOGIN AUDIT WORKSTATION
64 PRELIMINARY HOUSEKEEPIN
6.5 TARGETING THE DATA FILES
7.0 USING AUDIT WORKSTATIONS.
8.0 EXTRACTOR CLIENT FUNCTIONALITY...
8.1 NEw RFI.
8.2 CLOSE RFI.
8.3 AUDIT EXTRACTOR CLIENT — RETRIEVER SCREEN
8.4
9.0 NT EXPLORER....
10.0 INTRODUCTION TO R-QUER'
10.1 INVOKING R-QUERY AND CONNE!
10.2 RQUERY MAIN SCREEN....
10.2.1 Save and Restore - Restoring Retrieval Scenario:
10.2.2 Where - Changing Retrieval Parameters...
10.2.3 Select Cols - Selecting TMS Fields for Disp
10.2.4 Order By Tab...
10.2.5 Groups Tab.
10.2.6 Output Options.
10.3. RUNNING THE QUERY.
11.0 DATA RETRIEVAL - MISSING DAY.
ING TO A CORRESPONDE
Company-in-Confidence Page: 5 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176543
FUJ00176543
Fujitsu Services Audit Data Extraction Process Ref: TA/PRO/004
Version: 2.1
Company-in-Confidence Date: 26/10/2004
12.0 DATA RETRIEVAL —- NO RECORDS FOUND.
CREATING CDS.
13.0 DESPATCH OF AUDIT DATA.
14.0 APPENDIX.
14.1.1...
14.L.1.1 Heading 4 St essen a ae . . sos
14.L.1.1.1 Heading 5 Style . 38
Company-in-Confidence Page: 6 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176543
FUJ00176543
Fujitsu Services Audit Data Extraction Process Ref: TA/PRO/004
Version: 2.1
Company-in-Confidence Date: 26/10/2004
1.0 Introduction
The Horizon system generates significant amounts of data that is of interest to Post Office Ltd
Internal Audit and other groups. The Horizon System Audit Manual [2], and the supporting
Audit Data Catalogues [4-8] provide further information on the structure, form and content of
this data, referred to in this document as ‘audit data’.
Subject to certain constraints the audit data must be made available to POLIA or other
authorised groups within time scales established in the Audit Data Retrieval Requirements
(CSR+) [3] and the Network Banking Internal Audit Requirements [10].
This document establishes the process for requesting audit data extractions and subsequent
activities undertaken to locate, retrieve, extract & filter and prepare for despatch on behalf of
authorised requesters.
2.0 Scope
Should future releases of Horizon bring about changes to the way that data is extracted this
process will be updated to reflect those changes.
This process applies to ALL audit data extraction requests in respect of:
1. PSS ARQs
2. Other requests from POLIA.
3. Internal Requests
Internal requests for audit data extraction will also be subject to this process. In these cases
the use of an Audit Record Query (ARQ) form is optional but a PinICL must be raised to the
data extraction stack.
Company-in-Confidence Page: 7 of 38
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
Fujitsu Services
FUJ00176543
FUJ00176543
AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
3.0 Terminology
Within this process certain terms are used which have specific meaning within the Horizon
Audit Solution. They are:
Gatherer :
Sealer :
Hoarder :
Retriever :
Extractor :
The module responsible for collecting the audit files from the hosts, agents,
correspondence servers and interface mechanisms. This module is also
responsible for the application of the audit file naming policy.
The module responsible for calculating the checksum seal of each audit data file
before it is written to audit archive. This value is recalculated after data is
extracted by the Retriever and compared to the original value when first sealed.
Used to ensure data integrity during storage on audit archive.
The module responsible Pre-Bi3 for writing audit data files onto DLT at pre-
defined intervals. From Bi3 sealer writes audit data to Centera cubes.
The module responsible for moving audit data from the buffers where it is
placed when retrieved by Legato (Pre Bi3) or Centera (Post Bi3) and making it
available to Legato
The Client/Server system responsible for retrieving data from Legato and
Centera and managing Audit Data Extractions.
Legato: Legato Networker is the storage management application selected by Post
Office Account to store and manage audit data onto DLTs Pre-Bi3. Post-Bi3
the data is migrated to Centera cubes.
Centera: Online mass disk storage unit selected by Post Office Account to store and
manage audit data from Bi3.
A more complete explanation of these modules can be found in the Horizon System Audit
Manual [2].
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 8 of 9
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
4.0 Audit Data Integrity
The integrity of audit data must be guaranteed at all times from its origination, storage and
retrieval to subsequent despatch to the requester. Controls have been established to provide
assurances to Post Office Internal Audit that this integrity is maintained.
During audit data extractions the following controls apply:
a Extractions can only be made through the Audit Workstations, which exist at Feltham,
Bracknell and the 2 Data Centres. These are all subject to rigorous physical security
controls appropriate to that location. Specifically, the Feltham AWs — where most
extractions will take place — are located in secure rooms subject to proximity pass access
within a secured Fujitsu Services site.
a Logical access to the AWs and their functionality is controlled by dedicated Logins,
password control and utilises the NT and Post Office Account security features defined in
the overall Horizon security policy.
a All extractions are logged on the Audit System and supported by documented ARQs,
authorised by nominated persons within POLIA. This log can be scrutinised on the AWs.
a Extractions will only be undertaken by individuals previously notified to POLIA. Currently
this is limited to Post Office Account Audit and Post Office Account CS Security
Prosecution Support personnel. Any additions will be notified to POLIA.
a Agreement has been reached with POLIA regarding their rights to witness extractions
without warning or to request repeat extractions that they can witness.
a Checksum seals are calculated for audit data files when they are written to audit archive
and re-calculated when the files are retrieved.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 9 of 9
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
4.1 Retrieval Schematic
AUDIT SERVER AUDIT WORKSTATION
—— iow hed
——— aware
HECK SEAL eg)
_ _ __ lee’
sin I Raecar ae I ea wecory II arrgs O
sage _ mone
Device ORACLE ¢ —) auest
TABLE }— oracie Tables I 7 Discoverer
REBUILD
OPERATIONAL ENVIRONMENT quo exTmacror
etve-oracte 7} Direct tink to
Ne orc Ue eases
EXTRACTION vat
eveTeM Faimay oy
lanan24ina suppon Senice
FUJ00176543
FUJ00176543
© 2003 Fujitsu Services
COMMERCIAL IN-CONFIDENCE
Page: 10 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: 1A/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
5.0 Overview
The process assumes that audit data has been Gathered, Sealed and written to audit archive
The five main types of files are :
a. TMS Journals from the Correspondence Servers.
b. Flattened Oracle tables output from regular OBCS database purging cycles.
c. Transaction files to and from PO systems
d. AP Client Files
e Tivoli Event files
All file types are referenced in the audit data catalogues [4-8]
The process is invoked through the receipt of an ARQ into Post Office Account CS Security
PSS. Expressed in business terms, the ARQ must be interpreted into its component Audit
Points and Sub-points. This then enables specific files to be identified and retrieved by the
Audit Retriever, formatted as appropriate and then further Extracted against the ARQ criteria.
Depending on the extraction method the data can be extracted to standard MSExcel 95 before
being placed onto CD-W or floppy disc. The CD is then checked for despatch to the ARQ
originator.
The following paragraphs present an overview of each step in the extraction process and are
ordered to reflect the actual processing of a Audit Record Query (ARQ) by Post Office
Account CS Security PSS.
5.1 Audit Record Query
All POLIA requests for audit data must be made via the Audit Record Query form. This will
contain a description, in business terms, of the times, outlets, events, items activities that the
Auditors are interested in. This request has to be interpreted by Post Office Account CS
Security PSS and mapped onto the Audit Points and Files described later in this document.
Internal requests (e.g. from Post Office Account investigations personnel) will typically be in
the form of a Peak on the ‘Dataextraction’ stack for CS Security.
5.2 Marking Files and Tapes
Based on the above interpretation of the ARQ, as many files of audit data that are needed to
satisfy the request are ‘marked’ for retrieval.
5.3. Audit Track Retriever
Polls the user area buffers and makes them available to sealer for seal verification
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 11 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: 1A/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Audit Data Check Seal
To assure the integrity of the audit data while on the audit archive the checksum seal for the
file is re-calculated by the Audit Track Sealer and compared to the original value calculated
when the file was originally written to the audit archive. The result is maintained in a Check
Seal Table.
5.4 Audit Trail Extractor
This is a facility that uses various tools to extract or reform the retrieved audit data in
accordance with the ARQ. It also places the information onto a CD-W, or other suitable
media, for despatch to the ARQ originator.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 12 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: 1A/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
6.0 Retrieving & Extracting Audit Data
6.1 Receiving the ARQ
a) POLIA requests for audit data extractions must come to Post Office Account CS Security
PSS in the form of an Audit Record Query. An example of this form can be found at Annex A.
The ARQ may be mailed, faxed or e-mailed to Post Office Account CS Security PSS.
ARQs will only be accepted from persons fulfilling the following role or their delegate :
POL Internal Audit. Casework Manager: Tel c
Current names of persons fulfilling this role will be confirmed in writing by POLIA Internal
Audit and held locally by PSS
If other parts of the Post Office, or other organisations, require audit data extractions they
must be channelled through POLIA to Post Office Account CS Security PSS.
Contractual limits and turnaround times for the provision of Audit Record Queries are detailed
in the document Network Banking Management of Prosecution Support. [11]
b) Internal requests will be in the form of a Peak, allowing the requestor’s identity to be
verified. Requestors should state what media is acceptable (e.g. CD-W, email of WinZipped
file up to 500kB) The despatching of confidential data is bound by Fujitsu Services policy. For
TMS files - also referred to as “message store” or “Correspondence Server”- they should also
specify the output file format(s): text, MS-Excel or MS-Access. (See Section 8 for more
information).
POLIA and Internal requests are recorded on the PSS Database (User Guide for
Prosecution Support Database [12]). They should be logged to record the following
information: Request id (e.g. ARQ no.), the date the request was received, the FAD and date
range to search. Turnaround times are covered by contract as specified in the CCD
CS/SER/016.
6.2. Interpreting the ARQ
It is necessary to interpret the ARQ by identifying the audit points and sub points that
generated the records that are required and, through the Audit Data Catalogues [4-8], the files
produced at those audit points and sub points.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 13 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
6.3 Login Audit Workstation
Carry out following procedure to Login and obtain necessary shares
1. Login 1 HH
2. Password : *####
3. Domain :PWYDCS
At this point the SecureID Authentication is invoked. See SecurID Normal Token User Guide
t hy out the following procedure to authenticate yourself as an authorised user
1. Enter passcode —_: <personal 6 digit PIN and 6 digit SecureID token display>
The AW will present a blank desktop with a START icon in the bottom left of the screen.
Using pull up <Programs> will reveal the extent of products available for any subsequent
extraction work, as shown in Figure 1.
Start Menu
Figure I
6.4 Preliminary Housekeeping
It is highly likely that an average ARQ will need a significant number of files to satisfy it. To
avoid the AW filestore becoming clogged with hundreds of files it is strongly recommended
that a working directory is established on the AW to hold all files relevant to a particular ARQ
1. Select <Windows_NT_Explorer> from the drop down menu.
2. Set up <New Folder> as D:\audit data\ARQ Reference No.
6.5 Targeting the Data Files
At this stage of the retrieval procedure the Audit Extractor Client is used to identify and mark
the files required for retrieval.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 14 of 38
Fujitsu Services AUDIT DATA EXTRACTION PROCESS
COMMERCIAL IN-CONFIDENCE
Ref:
Version:
Date:
FUJ00176543
FUJ00176543
1A/PRO/004
2A
15/09/04
7.0 Using Audit workstations
Each Audit Workstation is loaded with the following programs;
1. Audit Extractor Client
2. NT Explorer
3. RQuery
4. Roxio
An explanation of the functionality of each program is detailed in the following sections
8.0 Extractor Client Functionality
The Audit Extractor Client is invoked from the start menu. The user will select the Data
Centre they wish to work with as depicted in Figure 2. The Audit Extractor Client refers to
RFI (Request For Information). RFI is synonymous with ARQ.
Audit Extractor - Select Data Centre Ea]
‘About
Data Centre: = ~=—ti‘(i‘CéC Sr
; , Sa
Uaaone pa Audit Extractor Client - I _—_
Workstation. - WFEAUDOG Data Centre Selection \WFEAUDOS
Tay [xe] __ set
FGA Sareea RocenterrtI be :
The Audit Extractor Client (Figure 3) has three main options;
<New RFI> (Figure 4)
<Open RFI> (Figure 7)
<Close RFI> (Figure 9)
Figure 2
; Figure 3
You are logged in as
jhas!
atthe Audit Extractor Client -
Bootle Main Screen
data centre
iRae
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 15 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
8.1 New RFI
This option is used to setup an audit trail for each request and to specify the search criteria
identified from the ARQ form. See Figure 4.
ieee A
Hewat Se ie Deemed (eee
Cada tnly §— [——__Daleeguted [Saya
Receint Referee [Ej ————
‘Access Reason,
Pon Otis Name FAD code daterange equeed
Figure 4
Raise New Request
seagecm Iseeraame I tami
Requester — Drop down list.
Other 3”? party
Post Office Account IA (Post Office Internal Audit, ARQs are always POIA)
Post Office Account Other
Post Office Account SSC
POCLIA
POCL Other
POCL Security
Date Received — Date ARQ received, taken from ARQ form
Date Required — Date ARQ must be completed. Use SLA target times to calculate date to be
completed by
Catalogue Entry - Blank
Receipt Reference - ARQ Number, taken from ARQ form
Access Reason — Post Office Name, FAD and dates specified on ARQ form
<Specify Selection Criteria> See Figure 5 below.
From Date — The first date requested on the ARQ
To Date — The last date requested on the ARQ + 2 days. This ensures if data hoarded late that
all files are identified.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 16 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Aut Extracto econ Cia oF
ee at 7
Tine Ped Rees Figure 5
From Date [7Aaparsao1 Yo Bate [Sepemtn aa —
‘ud Pot Soci Ca
[Aspens [aust sapPaet Ta te
Specify Search Criteria
Figure 6
<Update> See Figure 6 above.
Audit points — Used to select AP Client files and Tivoli events, etc
Subpoints — Used to narrow audit point selection
FAD code — FAD code from ARQ
<Add> - input above value and click add to enter the details
<Delete> - Select any values in List of current Audit points and click delete to
remove them
<Return> - Click to return to Search Criteria Screen (Figure 5)
<Search files> — when file search completes, the ‘Retriever’ screen opens, see Figure
10.
<Save selection> - saves the selection criteria
<Return to menu>— returns to main screen (Figure 3)
<Save request> - saves the request
<Return to menu>— returns to main screen (Figure 3)
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 17 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
8.2 Open RFI Figure 7
Access Reason
Request Relaence [EE aaa ~]
Open Existing Request
Sp ietnaaa Fetun to Meru
Select the ‘Request Reference’ from the drop down list i.e. POIA001B
<Show Details> - Figure 8 below.
Pate Remiwed oo
I Figure 8
I Show Details
eS pa ——_ toda [ST ———_ -I
Wie Ses bg Saco eee
Rane Schnee I
I I
This lists the details of the request as inputted in Figure 4, New RFI. The user can not add or
update any fields.
Requester Details
e Requester
e Date Received
e Date Required
e Catalogue Entry
e Receipt Reference
e Access Reason
Selection Criteria
e From Date
e To Date
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 18 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
File Source Requirement
e Audit Points
e Sub Points
e FAD Code
e File Name Template
<Close> Closes ‘Details’ screen and returns to ‘Open RFI’ screen
<Open Request> Displays Figure 10
<Return To Menu> Returns to Figure 4
8.2 Close RFI
‘ose Ramon
ot T=] : Figure 9
Close Request
Figgas ha Retonen Ponagyy 2
When all work has been completed the ARQ must be closed on the Audit Extractor Client.
Request Ref - Select reference from drop down list (ref POIA***)
Access Reason
Filenames for RFI reference POIA**
<Close Request> - once the request is closed the audit log is written to the request directory
on the Audit Server, Figure 13. A copy of an example audit log can be viewed in appendix 2.
<Return To menu> - returns to Figure 4
<Show details> — Figure 8 this function displays the ARQ details as in ‘Show Details’ from
“Open RFI’ screen
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 19 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: = 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
8.3 Audit Extractor Client — Retriever Screen
Figure 10
Audit Extractor Client —
Retriever Screen
Selection Criteria
These fields are as entered on the ‘New RFI’ screen, Figure 4.
Time Period Required
From Date
To Date
File Source Required
Audit Point Selection Criteria
Audit Points
Audit Subpoints
FAD Code
Filename Template
File Names for RFI Reference POIA***
The Audit Extractor Client retrieves the following information using the search criteria
inputted in the ‘New RFT’ screen, Figure 4
Filename
Size
Status
Volume
Barcode
On-Line
Current List Control
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 20 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
<Amend Criteria> - If the original search criteria is too narrow, select this button to re-input
the search criteria and re-search for the required files. This facility is not available once files
have started to restore.
Selected File List Control
<Restore Files> - Mark the files required by either holding the <CTRL> key and marking the
individual files spaced throughout the range listed or select the first file in a group, hold the
<SHIFT> key and select the last file to mark a consecutive group of files. Once all the
required files are marked click the “Restore Files’ button to restore the files from archive.
<Replace Files> - Mark the required files, select “Replace Files’ and the files not selected will
be removed.
<Volume Status> - Again select the files required and click the ‘Volume Status’ button to
initiate a search for TMS Numbers and corresponding barcode reference for any audit tapes
required. This only applies to Pre Bi3 files stored in legato, not files held in Centera.
<Delete Files> - Similar to “Replace Files’ except the marked files are removed from the list.
<File Status> - this function updates the status of a set of selected files so that the user can
identify progress and seal validity.
<List Update> - this function updates the audit workstation in line with the audit server
<File Sizes> - This button will update file sizes for Legato based files, in the ‘Files Names for
RFI Reference POIA****” section for the marked files. The user will need to select ‘List
Update’ to view this on the audit workstation. Centera file sizes are shown in the original
selection list.
Main Menu
File / Close — This exits the ‘Retriever’ screen
Actions / Check Actions — Actions allow the user to view the status of each function/facility as
detailed throughout section 9.0 of this document, thus allowing the user to identify when each
process completes and if it completes successfully.
I
a -
Actions Screen
ft Figure 11
TMS
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 21 of 38
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref:
Version:
COMMERCIAL IN-CONFIDENCE Date:
IA/PRO/004
2A
15/09/04
FUJ00176543
FUJ00176543
Once the TMS Archive files have been deposited in EXTRACTED_AT they must be ‘built’
into a pseudo Correspondence Server for R-Query to access. Further filtering is available to
restrict the number of Outlet records that are included in the re-build activity based on the
original ARQ.
Clear MessageStore — This clears the current messagestore on the audit workstation
Generate MessageStore — enter the date parameters and FAD code, as depicted below
in Figure 12 and then ‘Generate MessageStore’ to generate the message store on the
audit workstation.
POIA1SOW
ne [September 2001 pate [2 0ctober 2001 Generate Message
messages messages
(ota eae Store Screen
Pos Otic FAD Code (2722'S Baes [22
«Delete
Figure 12
Server MS Build — Used to generate a messagestore on the audit server. Only one
workstation at a time can generate a messagestore on the audit server. This shall only
be used as a last resort.
Oracle / Build Table — Allows the user to rebuild Oracle back up files in the Oracle format.
Unzipping Zipped Flat Files - It is strongly recommended that files to be unzipped are
transferred from the AS to the AW in their zipped state and unzipped on the AW. This can
produce space savings of the order of 90%.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 22 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
9.0 NT Explorer
ase
NT Explorer
Figure 13
ete) st, MT TTT a be. Sa si Ba aia os *
sin] Sore FaI26 saucn[faltamene- FA Base Wad Dane mee ee
NT Explorer is used as a tool for viewing files associated with an ARQ. As each new request
is logged on the Audit Extractor Client using ‘New RFI’ a directory will be created on the
audit server for which the request was initiated from. Each directory takes the Audit
Extractor Client RFI Reference i.e. POIA****. This main directory holds the sub directories;
Extracted_at, Restore_at and Retrieved_at. The main directory includes a txt file named using
the Audit Extractor Client RFI reference. This files contains details of each process initiated
through the Audit Extractor Client. NT Explorer allows a window to view these files and
directories.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 23 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.0 Introduction to R-Query
R-Query is an interrogation tool used to extract data from a Correspondence Server. It has
powerful SQL type features, which are used to define the extraction scenarios and the ability
to output the results to standard MS-Office utilities.
It is a vital element in the Audit Workstation tool set and requires that a Correspondence
Server exists on one of the Audit Workstations or Servers. Details on how to achieve this pre-
requisite can be found earlier in this procedure.
10.1 Invoking R-Query and Connecting to a Correspondence
Server.
The Riposte Query initial screen is invoked from the start menu.
Figure 14
Riposte Query Initial Screen
Hed tre yet otacrind ete ane ‘You are: Connected fo Server WFEAUDUA (Group Node-1)
Connect To: [WFEALDOA Local Machine I Connect To: [WFEAUDGA, Loca Machine a)
Audit Trait: ij quired to supp fcaton f Pinay Live Servers ae beng: d ‘Audit Trail: i ri 0 .pply fastichcation f Primary Li feb
I see]
Sloe Welcome ToFQWeyLUK Puss telecte Message Ste fre at cbve, ue
saan Pei Cae S ‘Gamectio Check Sie in
fees) I] me [fee] ome me
Connect to — The user selects the workstation/server for which the message store exists
Audit Trail — User is only required to justify use of servers
<Set up> - Development only
<Disconnect> - disconnects any connection from current workstation to messagestore
<Connect to MessageStore> - ‘connect to’ and ‘audit Trail’ are to be specified before
connecting
<Check Store Status> - details of message ranges in the rebuilt message store.
<Main Menu> - Connects to the main RQuery Screens as detailed in the following sections.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 24 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.2 RQuery Main Screen.
This consists of 7 tabs.
Select Cols — Used to select attributes required for output to excel etc.
Where — Used to enter search criteria i.e. date range and FAD code
Order By — Used to specify sort criteria when output to excel
Save and Restore — Used to load and save Query
Output Options — Used to specify file and MS product to export data to.
Groups - Used to specify PAN or STAN identifier
Connect — Used to connect to Messagestore.
10.2.1 Save and Restore - Restoring Retrieval Scenarios
rver WFEAUDOA (Group:0 Node:41)
SS
Saving and estonng quates using LOCAL disk les
I Fisutvescy =}
Abthe Data I
Jane's Most Common I ‘ I
Groupid forFiposte I299996
I Save and Retiave Oueties using Message Store Save and Restore
Queries can be inthe Riposte - Crbowd
store, or in disk files 1 a
l
un Query
The <Save and Restore> dialogue provides the opportunity to restore scenarios that have
already been scripted for further use.
SCENARIOS FOR RE-USE EXIST AT TWO LEVELS:
Those that are associated with the current Correspondence Server.
Those that have been saved to an external file or Catalogue.
Scenarios associated with the Correspondence Server exist only while that particular CS
exists. If the user believe that an extraction scenario is likely to be re-usable it’s as well to
remember that unless the scenario is saved to an external file it will not be available if a new
CS is built for another retrieval exercise.
Use these steps to re-use scenarios associated with current Correspondence Server.
Go to ‘Save and Retrieve Queries using Message Store’ window.
Select <Refresh> to list all scenarios associated with the current Correspondence Server.
Highlight the required scenario and select <Retrieve>
OR
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 25 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Use this step if retrieving scenarios from the Catalogue.
Locate stored scenario from the Catalogue via <Change filename> button to browse as
required.
At this stage the user will have retrieved the scenario complete with the parameter setting used
on the last retrieval activity. If the user want to change any of the parameters they will need to
go to the <Where> tab.
Enter the required Post Office (FAD) code into the <Group ID:> field if it is not shown.
10.2.2, Where - Changing Retrieval Parameters
(UK) V4.0. Connected to Server: WFEAUDOA (Group) Node:41)
I da I ‘ree [oesoom hart I brain Where Screen
[ (Date DGE “04Mey-2000") AND (Date
JOLE "11-May-2002" JAND (Exists (
IEPOSSTraneaction ProductNo)) AND (
[Exists ( TmData Start Date) )
Figure 16
Messages will only be used if they match these criteria See the documentation for
the appropriate syntax. H you are NOT on a production server an index may help if
‘you are doing multiple searches, (ote for UK: a Group = Post Office FAD code)
Fun Quey,
Note that the current version provides significant amounts of assistance with regard to the
structure of the query statement. An ‘Examples’ button (see Figure 17) allows search
parameters to be retrieved and tailored (e.g
(ideq TTAND (Mung "V400" J) OF_{(h0q°32°]AND Nn g"TOOOOOO™) Where Example
I Application EQ "APS" ) AND { Date DGE "08-Feb-1997" ) AND { Date DLE Te Magar" AND Ess (EPO
Apbstn £0 {TimData Mode £0 ER Screen
I Application EQ " ies J AND ( User EQ “CLKOO1" } AND [ Date DGE "08-Feb-1997" ) AND ( Date DLE "08-Ma_
(Application EQ "APS" I AND TxnData Mode EQ "ER
(Application EQ. ‘oBes" ‘AND { User EQ "CLKOOI" J AND. qf barose "08-Feb-1997" } AND { Date DLE "08+,
[ Colecton EQ "EPOSSUse") AND { Data LoggedOrAt EO _
I Cotecton GE "AP" J AND { Cofection LE "AQ" Figure 17
{ Data TranType EQ “Encashment" ) AND ( User EQ “CLKOD1" ) AND ( Application EQ "BES" } AND { Date DGI
I Sect vert Everstiane id" OR (SecuyE vert Evertlame EU "UserModted JOR I Secu
[User EQ "Smth OF User EQ “ones )AND ( Trarsscton EetyArount ge 5000 OR Exception Name EQ "Se
(Collection EQ "RiposteUsers"} OR (Secutyé vent EventName EQ “UserModified") OR Exists ( Seourilyé vent Ev
(Data Status EO "Voided"} OF ( Data Status EQ "HDVoided" }
Colecton £0 "Riposelsei.ogons
Cotecten £0 “HipasteUsre
Date EriyMethna Ne "0 a
Sib eed
(Date DGE “29-May-2000”) AND (Date DLE “01-Jun-2000”)
for all dates between 29 May-1 June 2000.
Date DEQ “31-May-2000”
for this day only.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 26 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Enter the required Post Office (FAD) code into the <Group ID:> field if it is not shown. If the
user want to change the TMS fields that will be visible following the retrieval they will need to
go to the <Select Cols> Tab.
Note: Riposte Query can only work with one FAD code (GroupID) at a time. It will need to
be run separately for each Post Office, remembering that by default it may delete the previous
output file
10.2.3. Select Cols - Selecting TMS Fields for Display
‘5. Riposte Query (UK}V4.0 Connected to WFEAUDOA (Group:0) Node:41) 3)
vaca oe I [ewe oe I oe
gt vee 112 F Expat Ente Messages
ens _I[User
HTsnDota Container 7 sad vb otra
Bigs _{[TrnOct0 Stan Date 1 AgIASO acer
HTxnDeta Start Time
Fete te I [THrDate Sessions
ecete mode Select Cols Screen
JEPOSSTransaction ProductNo I
EPOSSTrencacton SeleValue Figure 18
Select the columns for your report. Hf desired, can also include the entire
‘contents of all matching records in the spreadsheet. (Double click to edi)
Bun Quen I
Note that the current version provides lists of available fields per Horizon application which
can be selected by highlighting and pressing <Add> or <Add (tree view)>. See Figure 19
below. Alternatively to reduce the numbers of fields displayed highlight the field in the window
and press <Remove>.
Attribute: 7] Tree View
I stanbano I BANKING
Ace a sue) Add Columns
chet crc eros I ones I
ftectrert Data
eteten fetes ee Figure 19
Credit
Data CAP on CAPMarker nn est Ser
Data Mark nn
D:
=
Bas a é
Era
Se :
Eve TnseLock Fe) Se cia
Enter attribute details. either manually, from the
“recently used* dropdown, or from the selections
fence _I provided above
If the user want to retrieve the entire message for a given selection parameters <Remove> all
entries in the window and put an ‘x’ in the <Export Entire Messages> field.
Optionally a field “Add CAP and BP rollover data” or “Add ASCII Attachments — EG;
Network Banking“ can also be checked.
The user may now want to choose how the results of the retrieval will be presented. To do
this go to the <Output Options> Tab.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 27 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
Date: 15/09/04
COMMERCIAL IN-CONFIDENCE
Note: For TMS extractions, “Export Entire Messages” will normally be checked; the field
“Group!ID” is typically the only one selected via the “Add” button, ensuring that all rows are
linked to a FAD code in the output file.
10.2.4 Order By Tab
‘=. Rinoste Query {UK} V4.0. Connected to Server: WFEAUDO4 (Group-0 Node:41) Ea
sues I Where I oseros I Site I oman] Groune I Connect
Agd.>> [Atribute TanData Sten Date> Type Date><Order Forward
cAtibute TanData Stent Time><Type Sting» «Order Forward>
Remove <
Pea Order By
Sot By Dae
Figure 20
‘The messages in the report will be sorted in the order specified. Note that if
the report covers multiple offices. each office will produce its' own sorted
report. There is no sorting perforined across offices.
pay a :
Selecting the parameter “Sort By Date” is recommended to ensure ascending time sequence
(where appropriate).
10.2.5 Groups Tab
x: WFEAUDO4 (Group:0 Node:41)
Query {UK} V4.0 Connected to
Seo
I STAN: Jexcooos3e9054763001 :
- PAN: [44000NA98547600002_ if Figure 21
I The requirements for cross-office searching are vague and TBD since
I the demise of BES. Feedback required.
aeaisie, Indexed search across all offices
dd.2> I Remove « :
an search a single group, specified groups, or all groups with records for
given STAN or PAN. (Note for UK: 8 Group = Post Office FAD code)
=
The Groups tab on the R-Query tool is used to specify PAN search criteria.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 28 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.2.6 Output Options
to Server WFEAUDO4 (Group: Node:41)
‘S.Riposte Query (UK) V4.0 Com
I Automatic Exmot
I fe\audi2e_BES_Usrids Change
Output Options
Figure 22
© Automatic Expt
I) fe\Auditab_8ES_Usrmdb Change
T Expt to Tes Fe
Pun ues
By default an Excel spreadsheet is created (default name when selected:
C:\Audit\2a_BES_Usr.xls). In the current version there is also an option to export to an MS-
Access database (default name when selected: C:\Audit\2b_BES_Usr.mdb) and a text output
file.
If the user want to export the retrieved message to either an Excel spreadsheet or an Access
database then enter ‘x’ in the “Export Results to Excel/Access, Prompt Export” field.
Using the template.qry file found in d:\audit data gives the report format as shown below
X Microsoft Excel [ioe
S] fe Es Vow wt Fumat Took Dots Wee Heb 28x)
Olle! alalyI siesleleI oo) ela) gilzil is] @]4I fo =) ole]
= fos) wl zI of else fs) wl ocd, [sal ea)
a
3 Tao a EE Excel Output
aT [Figoste Veseaqe Oven UOT
[2 oate oen187 I
atime 122610 PM .
[os Group: 951641 Figure 23
5
Enists(Logon)
<key <Aitibute Date><Type Date> <OrdarFonand>>
ica “key <Atnbute Time><Type:Sting> <OrderFonvard>>
2
[10 Date Time Logon
[at] 23Mag7 152402 SETUPOI
[12 ) 24Ma97___ 070858 SETUPO!
[aa 24Mar87 10.3830 SETUPOI
[aa 24Ma-S7_10.4501 BBANTI
[15) 24Mag7 12.2018 BBANTI
[16] 24Mara? 130701 BBANTI
{a7 24MarS7 135905 BBANTI
[1 24Mag7 170434 BBANTL
ca 25.MarS7__ 06-1204 BBANTI
{20) 25Ma-S7 094337 BBANTI
a 25MacS7__ 10.2852 BBANTI
Details of the query statement used will appear on the spreadsheet and this provides the
evidence to POLIA of the search criteria used, in other words, how their ARQ has been
interpreted.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 29 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.3 Running the Query
Normally the user would not actually execute the retrieval scenario until such time as they had
built the query statement (the Where tab), selected the fields (Select Cols) and chosen the
output medium (Output Options). However, at any time in this sequence they can run the
query statement by selecting <Run Query> using the button on the “Save and Restore” tab.
Enter the required Post Office (FAD) code into the <Group ID:> field if it is not shown.
Once this has been done an intermediate screen will be displayed, allowing the file format to be
confirmed — select the <Excel> or <Access> buttons or the “text” icon, as appropriate to
commence loading the package and complete the data transfer. This will also allow the data
format to be checked on-screen.
Note: In the case of very large Correspondence Server files spanning a number of days, an
error may be generated on trying to save an Excel file. This will be because the maximum
number of rows (records) has been exceeded. Should this occur, the range of dates should be
covered, say one or two days at a time, and a number of output files generated.
In rare cases it will theoretically be possible to produce a text output file that is too big to be
read by Wordpad. Should this occur, a possible response is to produce output files for a
smaller range of dates, or to initially create data as an Excel working file which can be ‘Save
As’ “Text, OS/2 or MS-DOS”.
It is good practice to check that all output files can be opened before they are copied to floppy
disk or CD-W for onward transmission.
11.0 Data Retrieval — Missing Day
If while retrieving data for an ARQ there is no data retrieved for a day, or a sequence of days (but not
all days) duplicate retrieval of data for those missing days from the other server to ensure consistency.
If both servers are consistent, re-run R-Query using templateMissingDay,rft from the day before to the
day after the missing day.
The spreadsheet is sorted by ID and Number
Check that the number sequencing is contiguous from day to day - normal, automatic housekeeping
events, both during the early hours, and at the end of the normal working day, will be present.
If the numbering system is contiguous, it means that there is no sales activity records absent. If in
doubt, call Alan Holmes to verify.
Save the spreadsheet to the ARQ directory and name using the missing day(s) as the title.
Select Readme for missing day.frt (if not on audit station use from Janes Directory on Bootle) and
complete and save to ARQ directory.
Both should be sent to POL along with the normal ARQ data.
Example - ARQ 464
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 30 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
12.0 Data Retrieval — No Records Found
In the event that during R-Query a message of ‘No Records Found’ is presented for a series of days, it
may be that the outlet has been assigned to the incorrect cluster in Horizon. Another symptom of this
error is that only two files are brought forward when connecting to the store, and checking for gaps.
Check with Mik Peach, BRAOI, Tel! I
Ask him to check which cluster the outlet should be assigned to. If it is incorrect in Horizon Brian
Muir/Alan Holmes should be advised.
Until the necessary changes are made in the system a manual selection of the cluster will be necessary.
To connect to the correct cluster follow these steps:-
1. Start a new query in Horizon
nN
Specify dates required and select ‘update’, as usual
3. DO NOT enter FAD code into the ‘PO FAD Code’ box as usual
4. Under ‘Audit Point’ select ‘TMS’
5
. Under ‘Sub Point’ select correct cluster ie ‘Cluster 1B’ or “Cluster 1W’ _ depending on the
server already selected
6. Return, in the ‘FileName template’ box type:
FNO1_TMS_CLUSTERXX_X_X_*
CLUSTERXX - type the relevant cluster code ie CLUSTERIB
Third X - CLUSTERXX_X — type W or B depending on server chosen
Fourth X — CLUSTERXX_X_X - type number displayed on original ARQ request which resulted in
“No Records Found’ from ‘Filename for ARQ Ref POIA...’ ie “FNO1_TMS_CLUSTERIW_W_6 —
this number should also correspond with the third number of the FAD code.
7. Complete data extraction as usual
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 31 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: = 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Creating CDs
Roxio Easy CD Creater is used to copy the ARQ requested information on to CD-R, for
despatch to POLIA.
Format a diractCD disc, so you can drag flles to a CD
‘Share of archive your computer files such as images,
documents. spreadsheets, and presentations on CD.
Inthe most compatible format.
To launch CD Creator inserts a new CD-R in to the CD writer. This will launch the main
screen (Figure 24) The user selects “Make a Data CD”, then “Data CD Project” this initiates
the Data CD — Easy CD Creator Screen Figure 25.
{Sol te nikal
Fleer roar!
Fin Fee ovyovean12
Fie Fei ow/o103150
Fie Fei assim 140
Faro ossiimo 3
Finer osvae 2
Fle Fold, ona I
A
Data CD
Project Screen
1
Figure 25
_WWebiecis [Ota CO 7iokek IHLOTST CD-RW GCESIOOR [Track Athos
From here the user selects the source file from the drop down box. The source file should be
held on the D:\ under Auditdata\ARQ***. The files will appear in the top window, the user
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 32 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
will then drag and drop the required files to the lower window. All CD’s will be recorded as
‘Closed’ to prevent any further data being added to the CD. The CD-W shall be passed to CS
Security and checked for viruses after the data has been written to it and before sending it to
Post Office Ltd.
In order to adopt “best practice’ processes all data retrieval completed by Security Department staff is
to be checked by another prior to despatch. These notes contain the fundamental checks required.
A copy of the original request received from Post Office Limited and the resultant CD will be passed to
the checker. The following initial checks should be made:-
¢ The FAD code has been ticked as checked on the ARQ form
e — The written details on the disk reflect the requirements of the ARQ
¢ The detail of the retrieval has been recorded on the ARQ form
Open the CD, the following checks should be made:-
e The transaction and event files cover the timeframe requirements of the ARQ
¢ Open the transaction spreadsheet and check the timeframes match the requirements and that the
first and last day of the request are present
¢ Check Group, at the top of the spreadsheet, and FAD number on ARQ form are the same
¢ Select sheet 2 and check the FAD number listed in column I is correct
¢ — She files used cover the timeframe plus 2 days
* ‘Size of Gaps’ equals ‘None’
© Close transaction spreadsheet and open events spreadsheet
e Again, check FAD number and timeframe(s)
¢ Logon is present at the top of the data retrieved for the first day of the ARQ timeframe requirement
(be aware some reports are produced automatically and can be present prior to log on)
¢ Log off is present at the bottom of the data retrieved for the last day of the ARQ timeframe
requirement — if a day(s) is missing check whether day(s) falls on a Sunday or Bank holiday
¢ Duplicate audit details to those recorded on sheet 2 of the transaction spreadsheet are also held on
the events spreadsheet, select sheet 2 and perform a similar check
© Close events spreadsheet
¢ Retrieval data is held in both 95 and 97 formats
¢ Open Readme first file and check correct ARQ number has been entered and that personal details
and anti-virus information is correct
¢ Close all spreadsheets and open Access database
e Ensure all data has been recorded and select own name from the drop down “Checked by” list
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 33 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: 1A/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
¢ Initial ARQ form as checked and pass back to originator
13.0 Despatch of Audit Data
The audit data is despatched to POLIA contact using Royal Mail Special Delivery. This
ensures that a receipt is provided to Post Office Account confirming delivery.
The Prosecution Support Database must be updated to record the date that the extraction
activity was started, completed and posted.
14.0 Appendix
Appendix 1 ARQ Form
Appendix 2 Example audit log
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 34 of 38
FUJ00176543
FUJ00176543
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Appendix 1
AUDIT RECORD QUERY
Originator: I Post Office Ltd Security Date: I dd/mm/ccyy
POBox 1
Casework Manager
Croydon CR9 1WN
Telephone:
Witness Statement I YES/NO REF NO. ARQ
(delete as applicable)
##HH/00
Information Requested
Date range:
Post Office I Name and FAD
GENERAL
DESCRIPTION /
FORMAT
REQUIREMENTS:
Specific Details: (PAN or equivalent identifier)
Signed
Date I dd/mm/ccyy
© 2003 Fujitsu Services
COMMERCIAL IN-CONFIDENCE Page: 35 of 38
Fujitsu Services AUDIT DATA EXTRACTION PROCESS
COMMERCIAL IN-CONFIDENCE
Ref:
Version:
Date:
IA/PRO/004
2A
15/09/04
FUJ00176543
FUJ00176543
Appendix 2
Log for closed RFI: POIAI49W
RFI created by: jh:
RFI Closed: 09/01/03 15:01:44
Actions:
Instance: 5
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 16:07:54
Ended At: 06/01/03 16:08:41
Generated by: rlal
Instance: 4
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 10:27:07
Ended At: 06/01/03 10:27:23
Generated by: jhas~:
Instance: 2
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 09:55:49
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 36 of 38
Fujitsu Services AUDIT DATA EXTRACTION PROCESS
COMMERCIAL IN-CONFIDENCE
Ref:
Version:
Date:
FUJ00176543
FUJ00176543
1A/PRO/004
2A
15/09/04
Ended At: 06/01/03 09:56:04
Generated by: jha:
Instance: I
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 09:49:37
Ended At: 06/01/03 09:50:23
Generated by: jha:
Instance: 0
CommandUsed: Create directory structure
ErrorCode: 0
Error message: No error message held.
StateID: ProcessOK
Started At: 06/01/03 09:48:48
Ended At: 06/01/03 09:48:59
Generated by: jha:
Files and status of files used by: POIA149W
This RFI did not utilise any files.
Total number of files utilised: 0
14.1.1
14.1.1.1 I Heading 4 Style
14.1.1.1.1 Heading 5 Style
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 37 of 38