AdminChange Format

AdminChange events occur when an administrator adds, updates, or deletes an object. The format is:

AdminChange <Hostname> <Time String> "- <Username> " <Event> <Category> '<ObjectName>'

Elements in the above format example are described as follows:

<HostName> is the name of the host.
<Time String> is the timestamp of the occurrence of the event, in the format: [<date>/<month>/<year>:<hour>:<minute>:<second> <difference from GMT>]. For example:
```
[27/Jun/2000:11:27:29 -0500]
```
<UserName> is the name of the user who generated the event.
<Event> is the name of the object event—namely:
```
Create
Delete
Update
UpdateField
```
<Category> is the object that is the target of the event—for example, Rule or UserDirectory.
<ObjectName> is the user-defined name for the object. Some object categories (such as RootConfig) have no ObjectName associated with them.

Here is an example of an AdminChange event format that was logged when administrator JLewis created the rule MyNewRule:

AdminChange MyHost [20/Jul/2001:10:26:15 -0500] "- JLewis" Create Rule 'MyNewRule'