viewaudit(8)

NAME

 

viewaudit - display audit records

 

 

 

SYNOPSIS

 

viewaudit

 

 

 

 

 

viewaudit [-Adate-time] [ -B

date-time ] [ -C] [ -cclasses]

[ -Ddate-time][-Eend-

 

 

record] [-eevents ] [ -iaudit-ids][-l] [ -mdel] [ -n] [ -p

privilege-results] [ -r

 

 

return-values ] [ -Sstart-record] [ -uusers] [-x]

 

 

 

viewaudit -h

 

 

 

DESCRIPTION

 

viewaudit(8) displays audit records. When invoked without options, viewaudit

 

 

displays all current local audit records. When invoked with options, viewaudit

 

 

displays only the selected records. By default, records are displayed in text format,

 

 

one token per line, with a comma as the field separator. The output can be modified

 

 

using the -C, -E, -l,-m

del, -n, -S, or -xoption.

 

Privileges

 

You must have auditadm or auditop privileges to run this command.

 

 

Refer to setprivileges(8) for more information.

 

OPTIONS

 

The following options are supported:

 

 

 

-Adate-time

Selects records that occurred at or after date-time. The date-

 

 

 

time argument is in local time. the -Aand -Boptions can

 

 

 

be used together to form a range. Valid values for date-time

 

 

 

are:

 

 

 

 

 

■ Absolute date-time :yyyymmdd[hh[mm[ss]]]

 

 

 

where:

 

 

 

 

■ yyyy = year (1970 is the earliest valid value)

 

 

 

■

mm = month (01–12)

 

 

 

 

■

dd = day (01–31)

 

 

 

 

■

hh = hour (00–23)

 

 

 

 

■

mm = minutes (00–59)

 

 

 

 

■

ss = seconds (00–59)

 

 

 

 

The default value is 00 for hh, mm, and ss.

 

 

 

 

 

 

System Administration

409