An audit log entry is written when service-status auditing is on, and a service performs a NetServiceStatus call that updates the service status (svcs_status). An audit entry is written only if the status of one of the following values changes:

• INSTALLED
  
• UNINSTALLED
  
• PAUSED
  
• CONTINUED (ACTIVE)

struct ae_servicestat {  unsigned short ae_ss_compname; /* offset */
  unsigned short ae_ss_username; /* offset */
  unsigned short ae_ss_svcname;  /* offset */
  unsigned short ae_ss_status;
  unsigned long  ae_ss_code;
  unsigned short ae_ss_text;     /* offset */
  unsigned short ae_ss_returnval;
};

where:

• ae_ss_compname is an offset (from the beginning address of the ae_servicestat data structure) to an ASCIIZ string indicating the requester that established the session.

• ae_ss_username is an offset (from the beginning address of the ae_servicestat data structure) to an ASCIIZ string indicating the name of the user who initiated the session. If 0, ae_ss_username and ae_ss_compname are the same.

• ae_ss_svcname is an offset (from the beginning address of the ae_servicestat data structure) to an ASCIIZ string indicating the name of a service.

• ae_ss_status is the service status being set.

• ae_ss_code is the service code being set.

• ae_ss_text is an offset to text being set.

• ae_ss_returnval is the return value.