AUDITRECORD(8) | Maintenance Commands and Procedures | AUDITRECORD(8) |
auditrecord - display audit record formats
/usr/sbin/auditrecord [-d] [ [-a] | [-e string] | [-c class] |
[-i id] | [-p programname] | [-s systemcall] | [-h]]
The auditrecord utility displays the event ID, audit class and selection mask, and record format for audit record event types defined in audit_event(5). You can use auditrecord to generate a list of all audit record formats, or to select audit record formats based on event class, event name, generating program name, system call name, or event ID.
There are two output formats. The default format is intended for display in a terminal window; the optional HTML format is intended for viewing with a web browser.
Tokens contained in square brackets ( [ ] ) are optional and might not be present in every record.
The following options are supported:
-a
-c class
-d
-e string
-h
-i id
-p programname
-s systemcall
The -p and -s options are different names for the same thing and are mutually exclusive. The -a option is ignored if any of -c, -e, -i, -p, or -s are given. Combinations of -c, -e, -i, and either -p or -s are ANDed together.
Example 1 Displaying an Audit Record with a Specified Event ID
The following example shows how to display the contents of a specified audit record.
% auditrecord -i 6152
terminal login
program /usr/sbin/login see login(1)
/usr/dt/bin/dtlogin See dtlogin
event ID 6152 AUE_login
class lo (0x00001000)
header
subject
[text] error message
return
Example 2 Displaying an Audit Record with an Event ID Label that Contains a Specified String
The following example shows how to display the contents of a audit record with an event ID label that contains the string login.
# auditrecord -e login terminal login
program /usr/sbin/login see login(1)
/usr/dt/bin/dtlogin See dtlogin
event ID 6152 AUE_login
class lo (0x00001000)
header
subject
[text] error message
return rlogin
program /usr/sbin/login see login(1) - rlogin
event ID 6155 AUE_rlogin
class lo (0x00001000)
header
subject
[text] error message
return
0
non-zero
/etc/security/audit_class
/etc/security/audit_event
See attributes(7) for descriptions of the following attributes:
ATTRIBUTE TYPE | ATTRIBUTE VALUE |
CSI | Enabled |
Interface Stability | Obsolete Uncommitted |
audit.log(5), audit_class(5), audit_event(5), attributes(7), auditconfig(8), praudit(8)
If unable to read either of its input files or to write its output file, auditrecord shows the name of the file on which it failed and exits with a non-zero return.
If no options are provided, if an invalid option is provided, or if both -s and -p are provided, an error message is displayed and auditrecord displays a usage message then exits with a non-zero return.
This command is Obsolete and may be removed and replaced with equivalent functionality in the future. This command was formerly known as bsmrecord.
If /etc/security/audit_event has been modified to add user-defined audit events, auditrecord displays the record format as undefined.
The audit records displayed by auditrecord are the core of the record that can be produced. Various audit policies and optional tokens, such as those shown below, might also be present.
The following is a list of praudit(8) token names with their descriptions.
group
sensitivity label
sequence
trailer
zone
March 6, 2017 | OmniOS |