auditrecord Command

The auditrecord command displays the format of audit events that are defined in the /etc/security/audit_event file. The output includes the event's audit ID, audit class, audit flag, and the record's audit tokens in order. With no option, the auditrecord output displays in a terminal window. With the -h option, the output is suitable for viewing in a browser. For examples of the use of the auditrecord command, see How to Display Audit Record Formats. Also, see the auditrecord(1M) man page.