To Display User Activity on a Selected Date

Use the -d option to the auditreduce command to see audit information collected during a specified 24-hour period.

In the following example, the security administrator checks to see when a user named doris logged in and logged out on April 13, 1997, by requesting the lo message class. The short-form date is in the form yymmdd. (The long form is described in the auditreduce(1M) man page.)

$ auditreduce -d 970413 --u doris -c lo | praudit