Now that you have seen how to initiate audit trails and read an audit trail file, consider the information the audit trail file contains. The audit trail file can contain three types of variables:

You can use additional statements in the PROC DATASETS step to control which variables appear in the audit trail. We consider each of the three types of variables that can be found in an audit trail.

As you might expect, the audit trail file has the same set of variables that are in the audited data set. If the data set contains the variables A and B, the variables A and B are also in the audit trail file.

Next consider the audit trail variables that automatically store information about changes that you make to the data.

Audit trail variables automatically store information about data modifications. Audit trail variable names begin with AT followed by a specific string, such as DATETIME.

The _ATOPCODE_ variable contains a code that describes the type of operation that wrote the observation to the audit file. For example, if you modified all observations in an audited data set, the audit file would contain twice as many observations as the original data set. The audit file would contain one observation that matched the original observation with an _ATOPCODE_ value of DR, and one updated observation with an _ATOPCODE_ value of DW.

Here are the possible values of the _ATOPCODE_ variable.

You can define what information is stored in the audit file by using the LOG statement when you initiate the audit trail.

When you initiate an audit trail, options in the LOG statement determine the type of entries that are stored in the audit trail, along with their corresponding _ATOPCODE_ values. The ERROR_IMAGE option controls E operation codes. The BEFORE_IMAGE option controls the DR operation code, and the DATA_IMAGE option controls all other D operation codes. If you omit the LOG statement when you initiate the audit trail, the default behavior is to log all images.

The following code initiates an audit trail on the data set Capinfo but stores only error record images. This means that the audit file contains only records where an error occurred. The _ATOPCODE_ values can be only EA, ED, and EU.

proc datasets nolist;
   audit capinfo;
   initiate;
   log data_image=NO before_image=NO;
quit;

User variables allow the person editing the file to enter information about changes that they are making to the data. Although the data values are stored in the audit file, you can update them in the data set like any other variable.

User variables are created by using the USER_VAR statement in the audit trail specification.

User variables are unique in SAS in that they are stored in one file (the audit file) and opened for update in another file (the data set). When the data set is opened for update, the user variables are displayed, and you can edit them as if they are part of the data set.

Suppose you must monitor the updates for the data set Capinfo. The following code initiates an audit trail for the data set Capinfo and creates two user variables, who and why, to store who made changes to the data set and why the changes were made.

proc datasets nolist;
   audit capinfo;
   initiate;
   user_var who $20 label = 'Who made the change'
            why $20 label = 'Why the change was made';
quit;

Once these user variables are set up, they are retrieved from the audit trail and displayed when the data set is opened for update. You can enter data values for the user variables as you would for any data variable. The data values are saved to the audit trail as each observation is saved. The user variables are not available when the data is opened for browsing or printing. To rename a user variable or modify its attributes, you modify the data set, not the audit file.