In this example, login/logout messages for a particular day are summarized in a file. The target file is written in a directory other than the normal audit root.
$ auditreduce --c lo -d 970413 -O /usr/audit_summary/logins |
The -O option creates an audit file in the /usr/audit_summary directory. The file name has 14-character timestamps for both start-time and end-time, and the suffix logins: /usr/audit_summary/19970413000000.19970413235959.logins