| blob | 96a1efb44ad1fc8e3b49c0f08e64f6edcfcc34ba |
1 '\" te
2 .\" Copyright (c) 2006 Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH AUDITREDUCE 8 "Mar 6, 2017"
7 .SH NAME
8 auditreduce \- merge and select audit records from audit trail files
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBauditreduce\fR [\fIoptions\fR] [\fIaudit-trail-file\fR]...
13 .fi
15 .SH DESCRIPTION
16 .LP
17 \fBauditreduce\fR allows you to select or merge records from audit trail files.
18 Audit files can be from one or more machines.
19 .sp
20 .LP
21 The merge function merges together audit records from one or more input audit
22 trail files into a single output file. The records in an audit trail file are
23 assumed to be sorted in chronological order (oldest first) and this order is
24 maintained by \fBauditreduce\fR in the output file.
25 .sp
26 .LP
27 Unless instructed otherwise, \fBauditreduce\fR will merge the entire audit
28 trail, which consists of all the audit trail files in the directory structure
29 \fIaudit_root_dir\fR/*/files. Unless specified with the -\fBR\fR or -\fBS\fR
30 option, \fIaudit_root_dir\fR defaults to \fB/etc/security/audit\fR. By using
31 the file selection options it is possible to select some subset of these files,
32 or files from another directory, or files named explicitly on the command line.
33 .sp
34 .LP
35 The select function allows audit records to be selected on the basis of
36 numerous criteria relating to the record's content (see \fBaudit.log\fR(4) for
37 details of record content). A record must meet all of the
38 \fIrecord-selection-option\fR criteria to be selected.
39 .SS "Audit Trail Filename Format"
40 .LP
41 Any audit trail file not named on the command line must conform to the audit
42 trail filename format. Files produced by the audit system already have this
43 format. Output file names produced by \fBauditreduce\fR are in this format. It
44 is:
45 .sp
46 .in +2
47 .nf
48 \fIstart-time\fR\fB\&.\fR\fI\|end-time\fR\fB\&.\fR\fI\|suffix\fR
49 .fi
50 .in -2
51 .sp
53 .sp
54 .LP
55 where \fIstart-time\fR is the 14-character timestamp of when the file was
56 opened, \fIend-time\fR is the 14-character timestamp of when the file was
57 closed, and \fIsuffix\fR is the name of the machine which generated the audit
58 trail file, or some other meaningful suffix (for example, \fBall\fR, if the
59 file contains a combined group of records from many machines). The
60 \fIend-time\fR can be the literal string \fBnot_terminated\fR, to indicate that
61 the file is still being written to by the audit system. Timestamps are of the
62 form \fIyyyymmddhhmmss\fR (year, month, day, hour, minute, second). The
63 timestamps are in Greenwich Mean Time (GMT).
64 .SH OPTIONS
65 .SS "File Selection Options"
66 .LP
67 The file selection options indicate which files are to be processed and certain
68 types of special treatment.
69 .sp
70 .ne 2
71 .na
72 \fB\fB-A\fR\fR
73 .ad
74 .sp .6
75 .RS 4n
76 All of the records from the input files will be selected regardless of their
77 timestamp. This option effectively disables the \fB-a\fR, \fB-b\fR, and
78 \fB-d\fR options. This is useful in preventing the loss of records if the
79 \fB-D\fR option is used to delete the input files after they are processed.
80 Note, however, that if a record is \fInot\fR selected due to another option,
81 then \fB-A\fR will not override that.
82 .RE
84 .sp
85 .ne 2
86 .na
87 \fB\fB-C\fR\fR
88 .ad
89 .sp .6
90 .RS 4n
91 Only process complete files. Files whose filename \fIend-time\fR timestamp is
92 \fBnot_terminated\fR are not processed (such a file is currently being written
93 to by the audit system). This is useful in preventing the loss of records if
94 \fB-D\fR is used to delete the input files after they are processed. It does
95 not apply to files specified on the command line.
96 .RE
98 .sp
99 .ne 2
100 .na
101 \fB\fB-D\fR \fIsuffix\fR\fR
102 .ad
103 .sp .6
104 .RS 4n
105 Delete input files after they are read if the entire run is successful. If
106 \fBauditreduce\fR detects an error while reading a file, then that file is not
107 deleted. If \fB-D\fR is specified, \fB-A\fR, \fB-C\fR and \fB-O\fR are also
108 implied. \fIsuffix\fR is given to the \fB-O\fR option. This helps prevent the
109 loss of audit records by ensuring that all of the records are written, only
110 complete files are processed, and the records are written to a file before
111 being deleted. Note that if both \fB-D\fR and \fB-O\fR are specified in the
112 command line, the order of specification is significant. The \fIsuffix\fR
113 associated with the latter specification is in effect.
114 .RE
116 .sp
117 .ne 2
118 .na
119 \fB\fB-M\fR \fImachine\fR\fR
120 .ad
121 .sp .6
122 .RS 4n
123 Allows selection of records from files with \fImachine\fR as the filename
124 suffix. If \fB-M\fR is not specified, all files are processed regardless of
125 suffix. \fB-M\fR can also be used to allow selection of records from files that
126 contain combined records from many machines and have a common suffix (such as
127 \fBall\fR).
128 .RE
130 .sp
131 .ne 2
132 .na
133 \fB\fB-N\fR\fR
134 .ad
135 .sp .6
136 .RS 4n
137 Select objects in \fBnew mode\fR.This flag is off by default, thus retaining
138 backward compatibility. In the existing, \fBold mode\fR, specifying the
139 \fB-e\fR, \fB-f\fR, \fB-g\fR, \fB-r\fR, or \fB-u\fR flags would select not only
140 actions taken with those \fBID\fRs, but also certain objects owned by those
141 \fBID\fRs. When running in \fBnew mode\fR, only actions are selected. In order
142 to select objects, the \fB-o\fR option must be used.
143 .RE
145 .sp
146 .ne 2
147 .na
148 \fB\fB-O\fR \fIsuffix\fR\fR
149 .ad
150 .sp .6
151 .RS 4n
152 Direct output stream to a file in the current \fBaudit_root_dir\fR with the
153 indicated suffix. \fIsuffix\fR can alternatively contain a full pathname, in
154 which case the last component is taken as the suffix, ahead of which the
155 timestamps will be placed, ahead of which the remainder of the pathname will be
156 placed. If the \fB-O\fR option is not specified, the output is sent to the
157 standard output. When \fBauditreduce\fR places timestamps in the filename, it
158 uses the times of the first and last records in the merge as the
159 \fIstart-time\fR and \fIend-time\fR.
160 .RE
162 .sp
163 .ne 2
164 .na
165 \fB\fB-Q\fR\fR
166 .ad
167 .sp .6
168 .RS 4n
169 Quiet. Suppress notification about errors with input files.
170 .RE
172 .sp
173 .ne 2
174 .na
175 \fB\fB-R\fR \fIpathname\fR\fR
176 .ad
177 .sp .6
178 .RS 4n
179 Specify the pathname of an alternate audit root directory \fIaudit_root_dir\fR
180 to be \fIpathname\fR. Therefore, rather than using
181 \fB/etc/security/audit\fR/*/files by default, \fIpathname\fR/*/files will be
182 examined instead.
183 .LP
184 Note -
185 .sp
186 .RS 2
187 The root file system of any non-global zones must not be referenced with the
188 \fB-R\fR option. Doing so might damage the global zone's file system, might
189 compromise the security of the global zone, and might damage the non-global
190 zone's file system. See \fBzones\fR(5).
191 .RE
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fB-S\fR \fIserver\fR\fR
198 .ad
199 .sp .6
200 .RS 4n
201 This option causes \fBauditreduce\fR to read audit trail files from a specific
202 location (server directory). \fIserver\fR is normally interpreted as the name
203 of a subdirectory of the audit root, therefore \fBauditreduce\fR will look in
204 \fIaudit_root_dir\fR/\fIserver\fR/files for the audit trail files. But if
205 \fIserver\fR contains any `\fB/\fR' characters, it is the name of a specific
206 directory not necessarily contained in the audit root. In this case,
207 \fIserver\fR/files will be consulted. This option allows archived files to be
208 manipulated easily, without requiring that they be physically located in a
209 directory structure like that of \fB/etc/security/audit\fR.
210 .RE
212 .sp
213 .ne 2
214 .na
215 \fB\fB-V\fR\fR
216 .ad
217 .sp .6
218 .RS 4n
219 Verbose. Display the name of each file as it is opened, and how many records
220 total were written to the output stream.
221 .RE
223 .SS "Record Selection Options"
224 .LP
225 The record selection options listed below are used to indicate which records
226 are written to the output file produced by \fBauditreduce\fR.
227 .sp
228 .LP
229 Multiple arguments of the same type are not permitted.
230 .sp
231 .ne 2
232 .na
233 \fB\fB-a\fR \fIdate-time\fR\fR
234 .ad
235 .sp .6
236 .RS 4n
237 Select records that occurred at or after \fIdate-time\fR. The \fIdate-time\fR
238 argument is described under \fBOption Arguments\fR, below. \fIdate-time\fR is
239 in local time. The \fB-a\fR and \fB-b\fR options can be used together to form a
240 range.
241 .RE
243 .sp
244 .ne 2
245 .na
246 \fB\fB-b\fR \fIdate-time\fR\fR
247 .ad
248 .sp .6
249 .RS 4n
250 Select records that occurred before \fIdate-time\fR.
251 .RE
253 .sp
254 .ne 2
255 .na
256 \fB\fB-c\fR \fIaudit-classes\fR\fR
257 .ad
258 .sp .6
259 .RS 4n
260 Select records by audit class. Records with events that are mapped to the audit
261 classes specified by \fIaudit-classes\fR are selected. Audit class names are
262 defined in \fBaudit_class\fR(4). Using the \fBaudit\fR \fIflags,\fR one can
263 select records based upon success and failure criteria.
264 .RE
266 .sp
267 .ne 2
268 .na
269 \fB\fB-d\fR \fIdate-time\fR\fR
270 .ad
271 .sp .6
272 .RS 4n
273 Select records that occurred on a specific day (a 24-hour period beginning at
274 00:00:00 of the day specified and ending at 23:59:59). The day specified is in
275 local time. The time portion of the argument, if supplied, is ignored. Any
276 records with timestamps during that day are selected. If any hours, minutes, or
277 seconds are given in \fItime,\fR they are ignored. \fB-d\fR can not be used
278 with \fB-a\fR or \fB\fR\fB-b\fR\fB\&.\fR
279 .RE
281 .sp
282 .ne 2
283 .na
284 \fB\fB-e\fR \fIeffective-user\fR\fR
285 .ad
286 .sp .6
287 .RS 4n
288 Select records with the specified \fIeffective-user.\fR
289 .RE
291 .sp
292 .ne 2
293 .na
294 \fB\fB-f\fR \fIeffective-group\fR\fR
295 .ad
296 .sp .6
297 .RS 4n
298 Select records with the specified \fIeffective-group.\fR
299 .RE
301 .sp
302 .ne 2
303 .na
304 \fB\fB-g\fR \fIreal-group\fR\fR
305 .ad
306 .sp .6
307 .RS 4n
308 Select records with the specified \fIreal-group.\fR
309 .RE
311 .sp
312 .ne 2
313 .na
314 \fB\fB-j\fR \fIsubject-ID\fR\fR
315 .ad
316 .sp .6
317 .RS 4n
318 Select records with the specified \fIsubject-ID\fR where \fIsubject-ID\fR is a
319 process ID.
320 .RE
322 .sp
323 .ne 2
324 .na
325 \fB\fB-m\fR \fIevent\fR\fR
326 .ad
327 .sp .6
328 .RS 4n
329 Select records with the indicated \fIevent\fR. The \fIevent\fR is the literal
330 string or the \fIevent\fR number.
331 .RE
333 .sp
334 .ne 2
335 .na
336 \fB\fB-o\fR \fIobject_type=objectID_value\fR\fR
337 .ad
338 .sp .6
339 .RS 4n
340 Select records by object type. A match occurs when the record contains the
341 information describing the specified \fIobject_type\fR and the object ID equals
342 the value specified by \fIobjectID_value.\fR The allowable object types and
343 values are as follows:
344 .sp
345 .ne 2
346 .na
347 \fBfile=\fIpathname\fR\fR
348 .ad
349 .sp .6
350 .RS 4n
351 Select records containing file system objects with the specified pathname,
352 where pathname is a comma separated list of regular expressions. If a regular
353 expression is preceded by a tilde (\fB~\fR), files matching the expression are
354 excluded from the output. For example, the option
355 \fBfile=~/usr/openwin,/usr,/etc\fR would select all files in \fB/usr\fR or
356 \fB/etc\fR except those in \fB/usr/openwin\fR. The order of the regular
357 expressions is important because auditreduce processes them from left to right,
358 and stops when a file is known to be either selected or excluded. Thus the
359 option \fBfile=\fR \fB/usr\fR, \fB/etc\fR, \fB~/usr/openwin\fR would select all
360 files in \fB/usr\fR and all files in \fB/etc\fR. Files in \fB/usr/openwin\fR
361 are not excluded because the regular expression \fB/usr\fR is matched first.
362 Care should be given in surrounding the \fIpathname\fR with quotes so as to
363 prevent the shell from expanding any tildes.
364 .RE
366 .sp
367 .ne 2
368 .na
369 \fBfilegroup\fI=group\fR\fR
370 .ad
371 .sp .6
372 .RS 4n
373 Select records containing file system objects with \fIgroup\fR as the owning
374 group.
375 .RE
377 .sp
378 .ne 2
379 .na
380 \fBfileowner=\fIuser\fR\fR
381 .ad
382 .sp .6
383 .RS 4n
384 Select records containing file system objects with \fIuser\fR as the owning
385 user.
386 .RE
388 .sp
389 .ne 2
390 .na
391 \fBmsgqid=\fIID\fR\fR
392 .ad
393 .sp .6
394 .RS 4n
395 Select records containing message queue objects with the specified \fIID\fR
396 where \fIID\fR is a message queue \fBID\fR.
397 .RE
399 .sp
400 .ne 2
401 .na
402 \fBmsgqgroup=\fIgroup\fR\fR
403 .ad
404 .sp .6
405 .RS 4n
406 Select records containing message queue objects with \fIgroup\fR as the owning
407 or creating group.
408 .RE
410 .sp
411 .ne 2
412 .na
413 \fBmsgqowner=\fIuser\fR\fR
414 .ad
415 .sp .6
416 .RS 4n
417 Select records containing message queue objects with \fIuser\fR as the owning
418 or creating user.
419 .RE
421 .sp
422 .ne 2
423 .na
424 \fBpid=\fIID\fR\fR
425 .ad
426 .sp .6
427 .RS 4n
428 Select records containing process objects with the specified \fIID\fR where
429 \fIID\fR is a process \fBID\fR. Process are objects when they are receivers of
430 signals.
431 .RE
433 .sp
434 .ne 2
435 .na
436 \fBprocgroup=\fIgroup\fR\fR
437 .ad
438 .sp .6
439 .RS 4n
440 Select records containing process objects with \fIgroup\fR as the real or
441 effective group.
442 .RE
444 .sp
445 .ne 2
446 .na
447 \fBprocowner=\fIuser\fR\fR
448 .ad
449 .sp .6
450 .RS 4n
451 Select records containing process objects with \fIuser\fR as the real or
452 effective user.
453 .RE
455 .sp
456 .ne 2
457 .na
458 \fBsemid=\fIID\fR\fR
459 .ad
460 .sp .6
461 .RS 4n
462 Select records containing semaphore objects with the specified \fIID\fR where
463 \fIID\fR is a semaphore \fBID\fR.
464 .RE
466 .sp
467 .ne 2
468 .na
469 \fBsemgroup=\fIgroup\fR\fR
470 .ad
471 .sp .6
472 .RS 4n
473 Select records containing semaphore objects with \fIgroup\fR as the owning or
474 creating group.
475 .RE
477 .sp
478 .ne 2
479 .na
480 \fBsemowner=\fIuser\fR\fR
481 .ad
482 .sp .6
483 .RS 4n
484 Select records containing semaphore objects with \fIuser\fR as the owning or
485 creating user.
486 .RE
488 .sp
489 .ne 2
490 .na
491 \fBshmid=\fIID\fR\fR
492 .ad
493 .sp .6
494 .RS 4n
495 Select records containing shared memory objects with the specified \fIID\fR
496 where \fIID\fR is a shared memory \fBID\fR.
497 .RE
499 .sp
500 .ne 2
501 .na
502 \fBshmgroup=\fIgroup\fR\fR
503 .ad
504 .sp .6
505 .RS 4n
506 Select records containing shared memory objects with \fIgroup\fR as the owning
507 or creating group.
508 .RE
510 .sp
511 .ne 2
512 .na
513 \fBshmowner=\fIuser\fR\fR
514 .ad
515 .sp .6
516 .RS 4n
517 Select records containing shared memory objects with \fIuser\fR as the owning
518 or creating user.
519 .RE
521 .sp
522 .ne 2
523 .na
524 \fBsock=\fIport_number|machine\fR\fR
525 .ad
526 .sp .6
527 .RS 4n
528 Select records containing socket objects with the specified \fIport_number\fR
529 or the specified \fImachine\fR where \fImachine\fR is a machine name as defined
530 in \fBhosts\fR(4).
531 .RE
533 .sp
534 .ne 2
535 .na
536 \fBfmri=\fIservice instance\fR\fR
537 .ad
538 .sp .6
539 .RS 4n
540 Select records containing fault management resource identifier (FMRI) objects
541 with the specified \fIservice instance\fR. See \fBsmf\fR(5).
542 .RE
544 .RE
546 .sp
547 .ne 2
548 .na
549 \fB\fB-r\fR \fIreal-user\fR\fR
550 .ad
551 .sp .6
552 .RS 4n
553 Select records with the specified \fIreal-user\fR.
554 .RE
556 .sp
557 .ne 2
558 .na
559 \fB\fB-s\fR \fIsession-id\fR\fR
560 .ad
561 .sp .6
562 .RS 4n
563 Select audit records with the specified \fIsession-id\fR.
564 .RE
566 .sp
567 .ne 2
568 .na
569 \fB\fB-u\fR \fIaudit-user\fR\fR
570 .ad
571 .sp .6
572 .RS 4n
573 Select records with the specified \fIaudit-user\fR.
574 .RE
576 .sp
577 .ne 2
578 .na
579 \fB\fB-z\fR \fIzone-name\fR\fR
580 .ad
581 .sp .6
582 .RS 4n
583 Select records from the specified zone name. The zone name selection is
584 case-sensitive.
585 .RE
587 .sp
588 .LP
589 When one or more \fIfilename\fR arguments appear on the command line, only the
590 named files are processed. Files specified in this way need not conform to the
591 audit trail filename format. However, \fB-M\fR, \fB-S\fR, and \fB-R\fR must not
592 be used when processing named files. If the \fIfilename\fR is ``\(mi'' then the
593 input is taken from the standard input.
594 .SS "Option Arguments"
595 .ne 2
596 .na
597 \fB\fIaudit-trail-file\fR\fR
598 .ad
599 .sp .6
600 .RS 4n
601 An audit trail file as defined in \fBaudit.log\fR(4). An audit trail file not
602 named on the command line must conform to the audit trail file name format.
603 Audit trail files produced as output of \fBauditreduce\fR are in this format as
604 well. The format is:
605 .sp
606 \fIstart-time . \|end-time . \|suffix\fR
607 .sp
608 \fIstart-time\fR is the 14 character time stamp denoting when the file was
609 opened. \fIend-time\fR is the 14 character time stamp denoting when the file
610 was closed. \fIend-time\fR can also be the literal string \fBnot_terminated\fR,
611 indicating the file is still be written to by the audit daemon or the file was
612 not closed properly (a system crash or abrupt halt occurred). \fIsuffix\fR is
613 the name of the machine that generated the audit trail file (or some other
614 meaningful suffix; for example, \fBall\fR would be a good suffix if the audit
615 trail file contains a combined group of records from many machines).
616 .RE
618 .sp
619 .ne 2
620 .na
621 \fB\fIdate-time\fR\fR
622 .ad
623 .sp .6
624 .RS 4n
625 The \fIdate-time\fR argument to \fB-a\fR, \fB-b\fR, and \fB-d\fR can be of two
626 forms: An absolute \fIdate-time\fR takes the form:
627 .sp
628 \fI\fR yyyymmdd [ \fIhh\fR [ \fImm\fR [ \fIss\fR ]]]
629 .sp
630 where \fIyyyy\fR specifies a year (with 1970 as the earliest value), \fImm\fR
631 is the month (01-12), \fBdd\fR is the day (01-31), \fIhh\fR is the hour
632 (00-23), \fImm\fR is the minute (00-59), and \fIss\fR is the second (00-59).
633 The default is 00 for \fIhh\fR, \fImm\fR and \fIss\fR.
634 .sp
635 An offset can be specified as: \fB+\fR\fIn\fR \fBd\fR|\fBh\fR|\fBm\fR| \fBs\fR
636 where \fIn\fR is a number of units, and the tags \fBd\fR, \fBh\fR, \fBm\fR, and
637 \fBs\fR stand for days, hours, minutes and seconds, respectively. An offset is
638 relative to the starting time. Thus, this form can only be used with the
639 \fB-b\fR option.
640 .RE
642 .sp
643 .ne 2
644 .na
645 \fB\fIevent\fR\fR
646 .ad
647 .sp .6
648 .RS 4n
649 The literal string or ordinal event number as found in \fBaudit_event\fR(4). If
650 \fIevent\fR is not found in the \fBaudit_event\fR file it is considered
651 invalid.
652 .RE
654 .sp
655 .ne 2
656 .na
657 \fB\fIgroup\fR\fR
658 .ad
659 .sp .6
660 .RS 4n
661 The literal string or ordinal group ID number as found in \fBgroup\fR(4). If
662 \fIgroup\fR is not found in the \fBgroup\fR file it is considered invalid.
663 \fIgroup\fR can be negative.
664 .RE
666 .sp
667 .ne 2
668 .na
669 \fB\fIlabel\fR\fR
670 .ad
671 .sp .6
672 .RS 4n
673 The literal string representation of a MAC label or a range of two valid MAC
674 labels. To specify a range, use \fBx;y\fR where \fBx\fR and \fBy\fR are valid
675 MAC labels. Only those records that are fully bounded by \fBx\fR and \fBy\fR
676 will be selected. If \fBx\fR or \fBy\fR is omitted, the default uses
677 \fBADMIN_LOW\fR or \fBADMIN_HIGH\fR respectively. Notice that quotes must be
678 used when specifying a range.
679 .RE
681 .sp
682 .ne 2
683 .na
684 \fB\fIpathname\fR\fR
685 .ad
686 .sp .6
687 .RS 4n
688 A regular expression describing a pathname.
689 .RE
691 .sp
692 .ne 2
693 .na
694 \fB\fIuser\fR\fR
695 .ad
696 .sp .6
697 .RS 4n
698 The literal username or ordinal user ID number as found in \fBpasswd\fR(4). If
699 the username is not found in the \fBpasswd\fR file it is considered invalid.
700 \fIuser\fR can be negative.
701 .RE
703 .SH EXAMPLES
704 .LP
705 \fBExample 1 \fRThe auditreduce command
706 .sp
707 .LP
708 \fBpraudit\fR(8) is available to display audit records in a human-readable
709 form.
711 .sp
712 .LP
713 This will display the entire audit trail in a human-readable form:
715 .sp
716 .in +2
717 .nf
718 % auditreduce | praudit
719 .fi
720 .in -2
721 .sp
723 .sp
724 .LP
725 If all the audit trail files are being combined into one large file, then
726 deleting the original files could be desirable to prevent the records from
727 appearing twice:
729 .sp
730 .in +2
731 .nf
732 % auditreduce -V -D /etc/security/audit/combined/all
733 .fi
734 .in -2
735 .sp
737 .sp
738 .LP
739 This displays what user \fBmilner\fR did on April 13, 1988. The output is
740 displayed in a human-readable form to the standard output:
742 .sp
743 .in +2
744 .nf
745 % auditreduce -d 19880413 -u milner | praudit
746 .fi
747 .in -2
748 .sp
750 .sp
751 .LP
752 The above example might produce a large volume of data if \fBmilner\fR has been
753 busy. Perhaps looking at only login and logout times would be simpler. The
754 \fB-c\fR option will select records from a specified class:
756 .sp
757 .in +2
758 .nf
759 % auditreduce -d 19880413 -u milner -c lo | praudit
760 .fi
761 .in -2
762 .sp
764 .sp
765 .LP
766 To see \fBmilner\fR's login/logout activity for April 13, 14, and 15, the
767 following is used. The results are saved to a file in the current working
768 directory. Notice that the name of the output file will have \fBmilnerlo\fR as
769 the \fIsuffix\fR, with the appropriate timestamp prefixes. Notice also that the
770 long form of the name is used for the \fB-c\fR option:
772 .sp
773 .in +2
774 .nf
775 % auditreduce -a 19880413 -b +3d -u milner -c login_logout -O milnerlo
776 .fi
777 .in -2
778 .sp
780 .sp
781 .LP
782 To follow \fBmilner\fR's movement about the file system on April 13, 14, and 15
783 the \fBchdir\fR record types could be viewed. Notice that in order to get the
784 same time range as the above example we needed to specify the \fB-b\fR time as
785 the day \fBafter\fR our range. This is because \fB19880416\fR defaults to
786 midnight of that day, and records before that fall on \fB0415\fR, the end-day
787 of the range.
789 .sp
790 .in +2
791 .nf
792 % auditreduce -a 19880413 -b 19880416 -u milner -m AUE_CHDIR | praudit
793 .fi
794 .in -2
795 .sp
797 .sp
798 .LP
799 In this example, the audit records are being collected in summary form (the
800 login/logout records only). The records are being written to a summary file in
801 a different directory than the normal audit root to prevent the selected
802 records from existing twice in the audit root.
804 .sp
805 .in +2
806 .nf
807 % auditreduce -d 19880330 -c lo -O /etc/security/audit_summary/logins
808 .fi
809 .in -2
810 .sp
812 .sp
813 .LP
814 If activity for user \fBID\fR 9944 has been observed, but that user is not
815 known to the system administrator, then the command in the following example
816 searches the entire audit trail for any records generated by that user.
817 \fBauditreduce\fR queries the system about the current validity of \fBID\fR
818 9944 and displays a warning message if it is not currently active:
820 .sp
821 .in +2
822 .nf
823 % auditreduce -O /etc/security/audit_suspect/user9944 -u 9944
824 .fi
825 .in -2
826 .sp
828 .sp
829 .LP
830 To get an audit log of only the global zone:
832 .sp
833 .in +2
834 .nf
835 % auditreduce -z global
836 .fi
837 .in -2
839 .SH FILES
840 .ne 2
841 .na
842 \fB\fB/etc/security/audit/\fR\fIserver\fR\fB/files/*\fR\fR
843 .ad
844 .sp .6
845 .RS 4n
846 location of audit trails, when stored
847 .RE
849 .SH ATTRIBUTES
850 .LP
851 See \fBattributes\fR(5) for descriptions of the following attributes:
852 .sp
854 .sp
855 .TS
856 box;
857 c | c
858 l | l .
859 ATTRIBUTE TYPE ATTRIBUTE VALUE
860 _
861 Interface Stability See below.
862 .TE
864 .sp
865 .LP
866 The command invocation is Stable. The binary file format is Stable. The binary
867 file contents is Unstable.
868 .SH SEE ALSO
869 .LP
870 \fBpraudit\fR(8), \fBaudit.log\fR(4), \fBaudit_class\fR(4),
871 \fBgroup\fR(4), \fBhosts\fR(4), \fBpasswd\fR(4),
872 \fBattributes\fR(5), \fBsmf\fR(5)
873 .SH DIAGNOSTICS
874 .LP
875 \fBauditreduce\fR displays error messages if there are command line errors and
876 then exits. If there are fatal errors during the run, \fBauditreduce\fR
877 displays an explanatory message and exits. In this case, the output file might
878 be in an inconsistent state (no trailer or partially written record) and
879 \fBauditreduce\fR displays a warning message before exiting. Successful
880 invocation returns \fB0\fR and unsuccessful invocation returns \fB1\fR.
881 .sp
882 .LP
883 Since \fBauditreduce\fR might be processing a large number of input files, it
884 is possible that the machine-wide limit on open files will be exceeded. If this
885 happens, \fBauditreduce\fR displays a message to that effect, give information
886 on how many file there are, and exit.
887 .sp
888 .LP
889 If \fBauditreduce\fR displays a record's timestamp in a diagnostic message,
890 that time is in local time. However, when filenames are displayed, their
891 timestamps are in \fBGMT\fR.
892 .SH BUGS
893 .LP
894 Conjunction, disjunction, negation, and grouping of record selection options
895 should be allowed.
896 .SH NOTES
897 .LP
898 The \fB-z\fR option should be used only if the audit policy \fBzonename\fR is
899 set. If there is no zonename token, then no records will be selected.