The Process List window shows a list of all the processes that were observed in the audit trail. Each process is listed on a single line, and several basic facts for each process are displayed. You can sort on any column, and clicking on any process row will direct Audit Explorer to display details about that process in the Process Details window.
The five fields listed for each process are:
Audit Explorer uses its own internal identifier for each process called the session ID. A process's Process ID is only unique for that moment of time. At a later time a new process may be assigned the same Process ID. Because we need to uniquely identify each process, Audit Explorer uses its own internal identifier, the session ID.
This column identifies the process's Process ID.
This column identifies the number of records for this process.
This column identifies the user name (or user ID if no name can be found) under which the process was running. Since a process can change user IDs/names several times during its lifetime, this column displays the first non-root user name.
This column identifies the program that the process was running. Since a process can run many programs during its lifetime, the very last program executed is shown here. In some instances no program can be identified (e.g., if the process executed the program before this audit file started), so this field will be left blank. b