All actions in IMPAX that access protected health information generate audit records containing the relevant details about the event. Audit record information includes:
The IP address or host name of the machine used to access the data
The date and time of access
The user ID or process ID used to access the data
The event class and event type
Study identifier, if study information was changed
Patient identifier, if study information was changed
Audit records are stored in the IMPAX database in two tables:
The MAP_EVENT table stores the most recent audit records.
The MAP_EVENT_AUDIT table stores slightly older records.
By default, audit events are stored in the MAP_EVENT table for 1 day and the MAP_EVENT_AUDIT table for 60 days. MVF Task Scheduler is responsible for moving records from the MAP_EVENT table to the MAP_EVENT_AUDIT table and for removing records from the MAP_EVENT_AUDIT table.
Identifying audit events required by IHE
When an event is inserted into the MAP_EVENT table, the sent_to_arr (Sent To Audit Record Repository) column is set to F (Forward) if the event is an IHE event, and to NULL if it is not.
After the event is sent to the Audit Record Repository, the sent_to_arr column is set to T (Transferred). This column is carried over into the MAP_EVENT_AUDIT table when records are moved to that table.
 | Note: User account auditing is performed by the Application Server. The Connectivity Manager also performs some audit logging. For information about audit logging in the Application Server and Connectivity Manager, refer to their respective Knowledge Bases. |
Moving recent audit records to the older audit record table
Records in the MAP_EVENT table can be accessed through the Administration Tools Event Viewer. The MAP_EVENT_DAYS field in the MVF_TS_MODULE_CONFIG table specifies the number of days current audit records are kept in that table.
The CLEAN_MAP_EVENT field in the MVF_TS_CONFIG table specifies how often event records are moved from the MAP_EVENT table to the MAP_EVENT_AUDIT table. By default, records are moved every day at 2 AM.
At the specified times, MVF Task Scheduler moves all records to the MAP_EVENT_AUDIT table except those whose DATE_TIME_CREATED falls within the start of the current day minus MAP_EVENT_DAYS and those with a SENT_TO_ARR value of F. When MVF Task Scheduler has finished transferring records from the MAP_EVENT table to the MAP_EVENT_AUDIT table, an event is recorded in the MAP_EVENT table with an event_type of EVENTS_MOVED.
Example
If MAP_EVENT_DAYS is 1 and today is Thursday:
Records from Wednesday and Thursday are kept in the MAP_EVENT table.
Records for events that have not been sent to the Audit Record Repository are kept in the MAP_EVENT table.
All other records are moved to the MAP_EVENT_AUDIT table.
Removing older audit records from the system
Records in the MAP_EVENT_AUDIT table can be accessed through the SQL Server Query Analyzer or through CLUI.
 | Tip: To access the audit records through Query Analyzer, ensure that you are logged in using the AgfaService account; you cannot log into Query Analyzer using the Administrator account. |
After the configured number of days have passed, these older audit records are removed from the MAP_EVENT_AUDIT table. If you do not require records to be stored past the configured number of days, for example, if you have another audit management system to store auditing information, the records are deleted without further action. If you do require that the audit records be maintained for a longer length of time, MVF Task Scheduler can be configured to export the records to text files before removing them from the database. You can then store those files as required.
The MAP_EVENT_AUDIT_DAYS field in the MVF_TS_MODULE_CONFIG table specifies the number of days older audit records are kept in the MAP_EVENT_AUDIT table.
The CLEAN_MAP_EVENT_AUDIT field in the MVF_TS_CONFIG table specifies how often event records are removed from the MAP_EVENT_AUDIT table. By default, records are deleted every Saturday at 3 AM.
At the specified times, MVF Task Scheduler deletes all records from the table except those whose DATE_TIME_CREATED falls within the start of the current day minus MAP_EVENT_AUDIT_DAYS. For example, if MAP_EVENT_AUDIT_DAYS is 14 and the MVF Task Scheduler cleanup schedule falls on January 15, all records before January 1 are deleted from the table.
If MVF Task Scheduler is configured to export audit records to a file, it attempts to export the records to a single file. However, if MVF Task Scheduler fails during the export process or if more events arrive after the day was processed, a second file is created with the same name as the first file but with a .date_time extension.
When MVF Task Scheduler has finished exporting records or deleting records from the MAP_EVENT_AUDIT table, an event is recorded in the MAP_EVENT table with an event_type of EVENTS_AUDITED or EVENTS_DELETED.
| Note: By default, records are kept in the MAP_EVENT_AUDIT table for 60 days but MVF Task Scheduler attempts to delete older records from this table only every Saturday at 3 AM. This means that, depending on the day, the table may contain more than 60 days of records. |