How to Display Audit Record Formats

The following command displays the formats of all audit event records. This command operates on records in the audit_class, audit_event, and audit_record_attr files.

# bsmrecord -a

Example — Displaying the Format of an Audit Record

In this example, the format of the audit record with an ID of 6152 is displayed.

# bsmrecord -i 6152
# login: terminal login
program  /usr/sbin/login  see login(1)
event ID 6152             AUE_login
class  lo  (0x00001000)
header-token
subject-token
text-token   error message
exit-token
#