Go to main content

man pages section 8: System Administration Commands

Exit Print View

Updated: Thursday, March 14, 2019
 
 

praudit(8)

Name

praudit - print contents of an audit trail file

Synopsis

praudit [-lrsx] [-ddel] [filename]...

Description

praudit reads the listed filenames (or standard input, if no filename is specified) and interprets the data as audit trail records as defined in audit.log(5) man page. By default, times, user and group IDs (UIDs and GIDs respectively) are converted to their ASCII representation. Record type and event fields are converted to their ASCII representation. Only users with the PRIV_FILE_DAC_READ privilege can use the praudit utility. If the Trusted Extensions have been enabled, users must have the PRIV_SYS_TRANS_LABEL privilege. Both these privileges are included in the Audit Review rights profile.

Options

The following options are supported:

–ddel

Use del as the field delimiter instead of the default delimiter, which is the comma. If del has special meaning for the shell, it must be quoted. The maximum size of a delimiter is three characters. The delimiter is not meaningful and is not used when the –x option is specified.

–l

Print one line per record.

–r

Print records in their raw form. Times, UIDs, GIDs, record types, and events are displayed as integers. This option is useful when naming services are offline. The –r option and the –s option are exclusive. If both are used, a format usage error message is output.

–s

Display records in their short form. Numeric fields' ASCII equivalents are looked up by means of the sources specified in the /etc/nsswitch.conf file (see nsswitch.conf(5)). All numeric fields are converted to ASCII and then displayed. The short ASCII representations for the record type and event fields are used. This option and the –r option are exclusive. If both are used, a format usage error message is output.

–x

Print records in XML form. Tags are included in the output to identify tokens and fields within tokens. Output begins with a valid XML prolog, which includes identification of the DTD which can be used to parse the XML.

Files

/etc/security/audit_event

Audit event definition and class mappings.

/etc/security/audit_class

Audit class definitions.

/usr/share/lib/xml/dtd

Directory containing the versioned DTD file referenced in XML output, for example, adt_record.dtd.1.

/usr/share/lib/xml/style

Directory containing the versioned XSL file referenced in XML output, for example, adt_record.xsl.1.

Examples

Example 1 Generating an HTML Report of All Login/Logout Events
# auditreduce -c lo /var/audit/* | praudit -x | xsltproc - > logins.html

Attributes

See attributes(7) for descriptions of the following attributes:

ATTRIBUTE TYPE
ATTRIBUTE VALUE
Availability
system/core-os
Interface Stability
See below.

The command stability is evolving. The output format is unstable.

See Also

xsltproc(1), ethers(3C), gethostbyaddr(3C), getipnodebyaddr(3C), getpwuid(3C), audit.log(5), audit_class(5), audit_event(5), group(5), nsswitch.conf(5), passwd(5), attributes(7), privileges(7), getent(8)

Managing Auditing in Oracle Solaris 11.4.