Use the -d option to the auditreduce command to see audit information collected during a specified 24-hour period.
In the following example, the security administrator checks to see when a user named doris logged in and logged out on April 13, 1997, by requesting the lo message class. The short-form date is in the form yymmdd. (The long form is described in the auditreduce(1M) man page.)
$ auditreduce -d 970413 --u doris -c lo | praudit |