viewaudit(8)
System Administration 525
NAME viewaudit - display audit records
SYNOPSIS viewaudit
viewaudit [-A date-time] [ -B date-time ] [ -C] [ -c classes] [ -D date-time] [-E end-
record] [-e events ] [ -i audit-ids] [-l] [ -m del] [ -n] [ -p privilege-results] [ -r
return-values ] [ -S start-record] [ -u users] [-x]
viewaudit -h
DESCRIPTION viewaudit(8) displays audit records. When invoked without options, viewaudit
displays all current local audit records. When invoked with options, viewaudit
displays only the selected records. By default, records are displayed in text format,
one token per line, with a comma as the field separator. The output can be modified
using the -C, -E, -l,-m del, -n, -S, or -x option.
Privileges You must have auditadm or auditop privileges to run this command.
Refer to setprivileges(8) for more information.
OPTIONS The following options are supported:
-A date-time Selects records that occurred at or after date-time. The date-
time argument is in local time. the -A and -B options can be
used together to form a range. Valid values for date-time are:
Absolute date-time : yyyymmdd[hh[mm[ss]]]
where:
■ yyyy = year (1970 is the earliest valid value)
■ mm = month (01–12)
■ dd = day (01–31)
■ hh = hour (00–23)
■ mm = minutes (00–59)
■ ss = seconds (00–59)
The default value is 00 for hh, mm, and ss.
To Next Page
Loading...
