3.1.4.2.10 ICertAdminD2::GetAuditFilter (Opnum 40)

The GetAuditFilter method retrieves the list of events for which the CA server is currently set to create security audit events, as specified in [CIMC-PP].

 HRESULT GetAuditFilter(
   [in, string, unique] wchar_t const* pwszAuthority,
   [out] DWORD* pdwFilter
 );

pwszAuthority:  See pwszAuthority definition in section 3.1.4.1.1.

pdwFilter: An unsigned integer that specifies the current audit settings. This is a bitwise-OR combination of zero or more of the following values.

Value	Meaning
0x00000001	Audit CA server for the following events: ServerControl Registration of the ICertAdminD interface. Unregistration of the ICertAdminD interface.
0x00000002	Audit CA server for the following method calls: BackupPrepare BackupEnd
0x00000004	Audit CA server for the following method calls: ICertRequestD::Request ResubmitRequest DenyRequest SetAttributes SetExtensions ImportCertificate DeleteRow
0x00000008	Audit CA server for the following method calls: RevokeCertificate PublishCRL PublishCRLs
0x00000010	Audit CA server for the following method calls: SetCASecurity SetOfficerRights
0x00000020	Audit CA server for the following method calls: GetArchivedKey ImportKey
0x00000040	Audit CA server for the following method calls: SetCAProperty SetConfigEntry

The GetAuditFilter method is used to retrieve the audit filter currently in use (initialize to 0 during the registration of the interfaces and can be modified by a call to the SetAuditFilter method).