3.1.1.1.25.2.2 SearchIPAddressAuditByMacAddress

The SearchIPAddressAuditByMacAddress procedure can be used to search the ADM_IPAddressAuditTable based on the specified search condition.

The following are the input parameters for this procedure:

Param_MacAddress: The MAC address of the device for which the audit information is being requested.

Param_StartDate: The start date of the events pertaining to the specified MAC address being requested.

Param_EndDate: The end date for the events pertaining to the specified MAC address being requested.

Param_correlateUserLogon: A Boolean flag indicating whether the MAC address specified has to be correlated to user logon/logoff event information that might be in the table.

The following is the output parameter for this procedure.

Result_searchResult: This is a collection of IPAuditRecord having the result for the specified search criteria.

The following steps are involved:

  1. Enumerate the rows in the table that meet the following criteria:

    • TimeOfEvent is greater than or equal to Param_StartDate

    • TimeOfEvent is less than or equal to Param_EndDate

    • ClientId is equal to Param_MacAddress

  2. For each of the row enumerated above,

    1. Create an instance of IPAuditRecord, copy the row details to it and add it to Result_searchResult.

    2. If Param_correlateUserLogon flag is set, perform any additional correlation to the map the MAC address to the IP addresses and from IP addresses to the user logon/logoff event which might have occurred during the time period in an implementation specific manner.

    3. For each of the rows which have been obtained based on correlation, create the IPAuditRecord, copy the row details to it and add it to Result_searchResult.

  3. Return Result_searchResult as the output parameter.