| blob | 9098c10ad4702413111b7dc1ab31eed33b729402 |
1 '\" te
2 .\" Copyright (c) 2006 Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH AUDITREDUCE 1M "Apr 10, 2006"
7 .SH NAME
8 auditreduce \- merge and select audit records from audit trail files
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBauditreduce\fR [\fIoptions\fR] [\fIaudit-trail-file\fR]...
13 .fi
15 .SH DESCRIPTION
16 .sp
17 .LP
18 \fBauditreduce\fR allows you to select or merge records from audit trail files.
19 Audit files can be from one or more machines.
20 .sp
21 .LP
22 The merge function merges together audit records from one or more input audit
23 trail files into a single output file. The records in an audit trail file are
24 assumed to be sorted in chronological order (oldest first) and this order is
25 maintained by \fBauditreduce\fR in the output file.
26 .sp
27 .LP
28 Unless instructed otherwise, \fBauditreduce\fR will merge the entire audit
29 trail, which consists of all the audit trail files in the directory structure
30 \fIaudit_root_dir\fR/*/files (see \fBaudit_control\fR(4) for details of the
31 structure of the audit root). Unless specified with the -\fBR\fR or -\fBS\fR
32 option, \fIaudit_root_dir\fR defaults to \fB/etc/security/audit\fR. By using
33 the file selection options it is possible to select some subset of these files,
34 or files from another directory, or files named explicitly on the command line.
35 .sp
36 .LP
37 The select function allows audit records to be selected on the basis of
38 numerous criteria relating to the record's content (see \fBaudit.log\fR(4) for
39 details of record content). A record must meet all of the
40 \fIrecord-selection-option\fR criteria to be selected.
41 .SS "Audit Trail Filename Format"
42 .sp
43 .LP
44 Any audit trail file not named on the command line must conform to the audit
45 trail filename format. Files produced by the audit system already have this
46 format. Output file names produced by \fBauditreduce\fR are in this format. It
47 is:
48 .sp
49 .in +2
50 .nf
51 \fIstart-time\fR\fB\&.\fR\fI\|end-time\fR\fB\&.\fR\fI\|suffix\fR
52 .fi
53 .in -2
54 .sp
56 .sp
57 .LP
58 where \fIstart-time\fR is the 14-character timestamp of when the file was
59 opened, \fIend-time\fR is the 14-character timestamp of when the file was
60 closed, and \fIsuffix\fR is the name of the machine which generated the audit
61 trail file, or some other meaningful suffix (for example, \fBall\fR, if the
62 file contains a combined group of records from many machines). The
63 \fIend-time\fR can be the literal string \fBnot_terminated\fR, to indicate that
64 the file is still being written to by the audit system. Timestamps are of the
65 form \fIyyyymmddhhmmss\fR (year, month, day, hour, minute, second). The
66 timestamps are in Greenwich Mean Time (GMT).
67 .SH OPTIONS
68 .SS "File Selection Options"
69 .sp
70 .LP
71 The file selection options indicate which files are to be processed and certain
72 types of special treatment.
73 .sp
74 .ne 2
75 .na
76 \fB\fB-A\fR\fR
77 .ad
78 .sp .6
79 .RS 4n
80 All of the records from the input files will be selected regardless of their
81 timestamp. This option effectively disables the \fB-a\fR, \fB-b\fR, and
82 \fB-d\fR options. This is useful in preventing the loss of records if the
83 \fB-D\fR option is used to delete the input files after they are processed.
84 Note, however, that if a record is \fInot\fR selected due to another option,
85 then \fB-A\fR will not override that.
86 .RE
88 .sp
89 .ne 2
90 .na
91 \fB\fB-C\fR\fR
92 .ad
93 .sp .6
94 .RS 4n
95 Only process complete files. Files whose filename \fIend-time\fR timestamp is
96 \fBnot_terminated\fR are not processed (such a file is currently being written
97 to by the audit system). This is useful in preventing the loss of records if
98 \fB-D\fR is used to delete the input files after they are processed. It does
99 not apply to files specified on the command line.
100 .RE
102 .sp
103 .ne 2
104 .na
105 \fB\fB-D\fR \fIsuffix\fR\fR
106 .ad
107 .sp .6
108 .RS 4n
109 Delete input files after they are read if the entire run is successful. If
110 \fBauditreduce\fR detects an error while reading a file, then that file is not
111 deleted. If \fB-D\fR is specified, \fB-A\fR, \fB-C\fR and \fB-O\fR are also
112 implied. \fIsuffix\fR is given to the \fB-O\fR option. This helps prevent the
113 loss of audit records by ensuring that all of the records are written, only
114 complete files are processed, and the records are written to a file before
115 being deleted. Note that if both \fB-D\fR and \fB-O\fR are specified in the
116 command line, the order of specification is significant. The \fIsuffix\fR
117 associated with the latter specification is in effect.
118 .RE
120 .sp
121 .ne 2
122 .na
123 \fB\fB-M\fR \fImachine\fR\fR
124 .ad
125 .sp .6
126 .RS 4n
127 Allows selection of records from files with \fImachine\fR as the filename
128 suffix. If \fB-M\fR is not specified, all files are processed regardless of
129 suffix. \fB-M\fR can also be used to allow selection of records from files that
130 contain combined records from many machines and have a common suffix (such as
131 \fBall\fR).
132 .RE
134 .sp
135 .ne 2
136 .na
137 \fB\fB-N\fR\fR
138 .ad
139 .sp .6
140 .RS 4n
141 Select objects in \fBnew mode\fR.This flag is off by default, thus retaining
142 backward compatibility. In the existing, \fBold mode\fR, specifying the
143 \fB-e\fR, \fB-f\fR, \fB-g\fR, \fB-r\fR, or \fB-u\fR flags would select not only
144 actions taken with those \fBID\fRs, but also certain objects owned by those
145 \fBID\fRs. When running in \fBnew mode\fR, only actions are selected. In order
146 to select objects, the \fB-o\fR option must be used.
147 .RE
149 .sp
150 .ne 2
151 .na
152 \fB\fB-O\fR \fIsuffix\fR\fR
153 .ad
154 .sp .6
155 .RS 4n
156 Direct output stream to a file in the current \fBaudit_root_dir\fR with the
157 indicated suffix. \fIsuffix\fR can alternatively contain a full pathname, in
158 which case the last component is taken as the suffix, ahead of which the
159 timestamps will be placed, ahead of which the remainder of the pathname will be
160 placed. If the \fB-O\fR option is not specified, the output is sent to the
161 standard output. When \fBauditreduce\fR places timestamps in the filename, it
162 uses the times of the first and last records in the merge as the
163 \fIstart-time\fR and \fIend-time\fR.
164 .RE
166 .sp
167 .ne 2
168 .na
169 \fB\fB-Q\fR\fR
170 .ad
171 .sp .6
172 .RS 4n
173 Quiet. Suppress notification about errors with input files.
174 .RE
176 .sp
177 .ne 2
178 .na
179 \fB\fB-R\fR \fIpathname\fR\fR
180 .ad
181 .sp .6
182 .RS 4n
183 Specify the pathname of an alternate audit root directory \fIaudit_root_dir\fR
184 to be \fIpathname\fR. Therefore, rather than using
185 \fB/etc/security/audit\fR/*/files by default, \fIpathname\fR/*/files will be
186 examined instead.
187 .LP
188 Note -
189 .sp
190 .RS 2
191 The root file system of any non-global zones must not be referenced with the
192 \fB-R\fR option. Doing so might damage the global zone's file system, might
193 compromise the security of the global zone, and might damage the non-global
194 zone's file system. See \fBzones\fR(5).
195 .RE
196 .RE
198 .sp
199 .ne 2
200 .na
201 \fB\fB-S\fR \fIserver\fR\fR
202 .ad
203 .sp .6
204 .RS 4n
205 This option causes \fBauditreduce\fR to read audit trail files from a specific
206 location (server directory). \fIserver\fR is normally interpreted as the name
207 of a subdirectory of the audit root, therefore \fBauditreduce\fR will look in
208 \fIaudit_root_dir\fR/\fIserver\fR/files for the audit trail files. But if
209 \fIserver\fR contains any `\fB/\fR' characters, it is the name of a specific
210 directory not necessarily contained in the audit root. In this case,
211 \fIserver\fR/files will be consulted. This option allows archived files to be
212 manipulated easily, without requiring that they be physically located in a
213 directory structure like that of \fB/etc/security/audit\fR.
214 .RE
216 .sp
217 .ne 2
218 .na
219 \fB\fB-V\fR\fR
220 .ad
221 .sp .6
222 .RS 4n
223 Verbose. Display the name of each file as it is opened, and how many records
224 total were written to the output stream.
225 .RE
227 .SS "Record Selection Options"
228 .sp
229 .LP
230 The record selection options listed below are used to indicate which records
231 are written to the output file produced by \fBauditreduce\fR.
232 .sp
233 .LP
234 Multiple arguments of the same type are not permitted.
235 .sp
236 .ne 2
237 .na
238 \fB\fB-a\fR \fIdate-time\fR\fR
239 .ad
240 .sp .6
241 .RS 4n
242 Select records that occurred at or after \fIdate-time\fR. The \fIdate-time\fR
243 argument is described under \fBOption Arguments\fR, below. \fIdate-time\fR is
244 in local time. The \fB-a\fR and \fB-b\fR options can be used together to form a
245 range.
246 .RE
248 .sp
249 .ne 2
250 .na
251 \fB\fB-b\fR \fIdate-time\fR\fR
252 .ad
253 .sp .6
254 .RS 4n
255 Select records that occurred before \fIdate-time\fR.
256 .RE
258 .sp
259 .ne 2
260 .na
261 \fB\fB-c\fR \fIaudit-classes\fR\fR
262 .ad
263 .sp .6
264 .RS 4n
265 Select records by audit class. Records with events that are mapped to the audit
266 classes specified by \fIaudit-classes\fR are selected. Audit class names are
267 defined in \fBaudit_class\fR(4). The \fIaudit-classes\fR can be a comma
268 separated list of \fBaudit\fR \fIflags\fR like those described in
269 \fBaudit_control\fR(4). Using the \fBaudit\fR \fIflags,\fR one can select
270 records based upon success and failure criteria.
271 .RE
273 .sp
274 .ne 2
275 .na
276 \fB\fB-d\fR \fIdate-time\fR\fR
277 .ad
278 .sp .6
279 .RS 4n
280 Select records that occurred on a specific day (a 24-hour period beginning at
281 00:00:00 of the day specified and ending at 23:59:59). The day specified is in
282 local time. The time portion of the argument, if supplied, is ignored. Any
283 records with timestamps during that day are selected. If any hours, minutes, or
284 seconds are given in \fItime,\fR they are ignored. \fB-d\fR can not be used
285 with \fB-a\fR or \fB\fR\fB-b\fR\fB\&.\fR
286 .RE
288 .sp
289 .ne 2
290 .na
291 \fB\fB-e\fR \fIeffective-user\fR\fR
292 .ad
293 .sp .6
294 .RS 4n
295 Select records with the specified \fIeffective-user.\fR
296 .RE
298 .sp
299 .ne 2
300 .na
301 \fB\fB-f\fR \fIeffective-group\fR\fR
302 .ad
303 .sp .6
304 .RS 4n
305 Select records with the specified \fIeffective-group.\fR
306 .RE
308 .sp
309 .ne 2
310 .na
311 \fB\fB-g\fR \fIreal-group\fR\fR
312 .ad
313 .sp .6
314 .RS 4n
315 Select records with the specified \fIreal-group.\fR
316 .RE
318 .sp
319 .ne 2
320 .na
321 \fB\fB-j\fR \fIsubject-ID\fR\fR
322 .ad
323 .sp .6
324 .RS 4n
325 Select records with the specified \fIsubject-ID\fR where \fIsubject-ID\fR is a
326 process ID.
327 .RE
329 .sp
330 .ne 2
331 .na
332 \fB\fB-m\fR \fIevent\fR\fR
333 .ad
334 .sp .6
335 .RS 4n
336 Select records with the indicated \fIevent\fR. The \fIevent\fR is the literal
337 string or the \fIevent\fR number.
338 .RE
340 .sp
341 .ne 2
342 .na
343 \fB\fB-o\fR \fIobject_type=objectID_value\fR\fR
344 .ad
345 .sp .6
346 .RS 4n
347 Select records by object type. A match occurs when the record contains the
348 information describing the specified \fIobject_type\fR and the object ID equals
349 the value specified by \fIobjectID_value.\fR The allowable object types and
350 values are as follows:
351 .sp
352 .ne 2
353 .na
354 \fBfile=\fIpathname\fR\fR
355 .ad
356 .sp .6
357 .RS 4n
358 Select records containing file system objects with the specified pathname,
359 where pathname is a comma separated list of regular expressions. If a regular
360 expression is preceded by a tilde (\fB~\fR), files matching the expression are
361 excluded from the output. For example, the option
362 \fBfile=~/usr/openwin,/usr,/etc\fR would select all files in \fB/usr\fR or
363 \fB/etc\fR except those in \fB/usr/openwin\fR. The order of the regular
364 expressions is important because auditreduce processes them from left to right,
365 and stops when a file is known to be either selected or excluded. Thus the
366 option \fBfile=\fR \fB/usr\fR, \fB/etc\fR, \fB~/usr/openwin\fR would select all
367 files in \fB/usr\fR and all files in \fB/etc\fR. Files in \fB/usr/openwin\fR
368 are not excluded because the regular expression \fB/usr\fR is matched first.
369 Care should be given in surrounding the \fIpathname\fR with quotes so as to
370 prevent the shell from expanding any tildes.
371 .RE
373 .sp
374 .ne 2
375 .na
376 \fBfilegroup\fI=group\fR\fR
377 .ad
378 .sp .6
379 .RS 4n
380 Select records containing file system objects with \fIgroup\fR as the owning
381 group.
382 .RE
384 .sp
385 .ne 2
386 .na
387 \fBfileowner=\fIuser\fR\fR
388 .ad
389 .sp .6
390 .RS 4n
391 Select records containing file system objects with \fIuser\fR as the owning
392 user.
393 .RE
395 .sp
396 .ne 2
397 .na
398 \fBmsgqid=\fIID\fR\fR
399 .ad
400 .sp .6
401 .RS 4n
402 Select records containing message queue objects with the specified \fIID\fR
403 where \fIID\fR is a message queue \fBID\fR.
404 .RE
406 .sp
407 .ne 2
408 .na
409 \fBmsgqgroup=\fIgroup\fR\fR
410 .ad
411 .sp .6
412 .RS 4n
413 Select records containing message queue objects with \fIgroup\fR as the owning
414 or creating group.
415 .RE
417 .sp
418 .ne 2
419 .na
420 \fBmsgqowner=\fIuser\fR\fR
421 .ad
422 .sp .6
423 .RS 4n
424 Select records containing message queue objects with \fIuser\fR as the owning
425 or creating user.
426 .RE
428 .sp
429 .ne 2
430 .na
431 \fBpid=\fIID\fR\fR
432 .ad
433 .sp .6
434 .RS 4n
435 Select records containing process objects with the specified \fIID\fR where
436 \fIID\fR is a process \fBID\fR. Process are objects when they are receivers of
437 signals.
438 .RE
440 .sp
441 .ne 2
442 .na
443 \fBprocgroup=\fIgroup\fR\fR
444 .ad
445 .sp .6
446 .RS 4n
447 Select records containing process objects with \fIgroup\fR as the real or
448 effective group.
449 .RE
451 .sp
452 .ne 2
453 .na
454 \fBprocowner=\fIuser\fR\fR
455 .ad
456 .sp .6
457 .RS 4n
458 Select records containing process objects with \fIuser\fR as the real or
459 effective user.
460 .RE
462 .sp
463 .ne 2
464 .na
465 \fBsemid=\fIID\fR\fR
466 .ad
467 .sp .6
468 .RS 4n
469 Select records containing semaphore objects with the specified \fIID\fR where
470 \fIID\fR is a semaphore \fBID\fR.
471 .RE
473 .sp
474 .ne 2
475 .na
476 \fBsemgroup=\fIgroup\fR\fR
477 .ad
478 .sp .6
479 .RS 4n
480 Select records containing semaphore objects with \fIgroup\fR as the owning or
481 creating group.
482 .RE
484 .sp
485 .ne 2
486 .na
487 \fBsemowner=\fIuser\fR\fR
488 .ad
489 .sp .6
490 .RS 4n
491 Select records containing semaphore objects with \fIuser\fR as the owning or
492 creating user.
493 .RE
495 .sp
496 .ne 2
497 .na
498 \fBshmid=\fIID\fR\fR
499 .ad
500 .sp .6
501 .RS 4n
502 Select records containing shared memory objects with the specified \fIID\fR
503 where \fIID\fR is a shared memory \fBID\fR.
504 .RE
506 .sp
507 .ne 2
508 .na
509 \fBshmgroup=\fIgroup\fR\fR
510 .ad
511 .sp .6
512 .RS 4n
513 Select records containing shared memory objects with \fIgroup\fR as the owning
514 or creating group.
515 .RE
517 .sp
518 .ne 2
519 .na
520 \fBshmowner=\fIuser\fR\fR
521 .ad
522 .sp .6
523 .RS 4n
524 Select records containing shared memory objects with \fIuser\fR as the owning
525 or creating user.
526 .RE
528 .sp
529 .ne 2
530 .na
531 \fBsock=\fIport_number|machine\fR\fR
532 .ad
533 .sp .6
534 .RS 4n
535 Select records containing socket objects with the specified \fIport_number\fR
536 or the specified \fImachine\fR where \fImachine\fR is a machine name as defined
537 in \fBhosts\fR(4).
538 .RE
540 .sp
541 .ne 2
542 .na
543 \fBfmri=\fIservice instance\fR\fR
544 .ad
545 .sp .6
546 .RS 4n
547 Select records containing fault management resource identifier (FMRI) objects
548 with the specified \fIservice instance\fR. See \fBsmf\fR(5).
549 .RE
551 .RE
553 .sp
554 .ne 2
555 .na
556 \fB\fB-r\fR \fIreal-user\fR\fR
557 .ad
558 .sp .6
559 .RS 4n
560 Select records with the specified \fIreal-user\fR.
561 .RE
563 .sp
564 .ne 2
565 .na
566 \fB\fB-s\fR \fIsession-id\fR\fR
567 .ad
568 .sp .6
569 .RS 4n
570 Select audit records with the specified \fIsession-id\fR.
571 .RE
573 .sp
574 .ne 2
575 .na
576 \fB\fB-u\fR \fIaudit-user\fR\fR
577 .ad
578 .sp .6
579 .RS 4n
580 Select records with the specified \fIaudit-user\fR.
581 .RE
583 .sp
584 .ne 2
585 .na
586 \fB\fB-z\fR \fIzone-name\fR\fR
587 .ad
588 .sp .6
589 .RS 4n
590 Select records from the specified zone name. The zone name selection is
591 case-sensitive.
592 .RE
594 .sp
595 .LP
596 When one or more \fIfilename\fR arguments appear on the command line, only the
597 named files are processed. Files specified in this way need not conform to the
598 audit trail filename format. However, \fB-M\fR, \fB-S\fR, and \fB-R\fR must not
599 be used when processing named files. If the \fIfilename\fR is ``\(mi'' then the
600 input is taken from the standard input.
601 .SS "Option Arguments"
602 .sp
603 .ne 2
604 .na
605 \fB\fIaudit-trail-file\fR\fR
606 .ad
607 .sp .6
608 .RS 4n
609 An audit trail file as defined in \fBaudit.log\fR(4). An audit trail file not
610 named on the command line must conform to the audit trail file name format.
611 Audit trail files produced as output of \fBauditreduce\fR are in this format as
612 well. The format is:
613 .sp
614 \fIstart-time . \|end-time . \|suffix\fR
615 .sp
616 \fIstart-time\fR is the 14 character time stamp denoting when the file was
617 opened. \fIend-time\fR is the 14 character time stamp denoting when the file
618 was closed. \fIend-time\fR can also be the literal string \fBnot_terminated\fR,
619 indicating the file is still be written to by the audit daemon or the file was
620 not closed properly (a system crash or abrupt halt occurred). \fIsuffix\fR is
621 the name of the machine that generated the audit trail file (or some other
622 meaningful suffix; for example, \fBall\fR would be a good suffix if the audit
623 trail file contains a combined group of records from many machines).
624 .RE
626 .sp
627 .ne 2
628 .na
629 \fB\fIdate-time\fR\fR
630 .ad
631 .sp .6
632 .RS 4n
633 The \fIdate-time\fR argument to \fB-a\fR, \fB-b\fR, and \fB-d\fR can be of two
634 forms: An absolute \fIdate-time\fR takes the form:
635 .sp
636 \fI\fR yyyymmdd [ \fIhh\fR [ \fImm\fR [ \fIss\fR ]]]
637 .sp
638 where \fIyyyy\fR specifies a year (with 1970 as the earliest value), \fImm\fR
639 is the month (01-12), \fBdd\fR is the day (01-31), \fIhh\fR is the hour
640 (00-23), \fImm\fR is the minute (00-59), and \fIss\fR is the second (00-59).
641 The default is 00 for \fIhh\fR, \fImm\fR and \fIss\fR.
642 .sp
643 An offset can be specified as: \fB+\fR\fIn\fR \fBd\fR|\fBh\fR|\fBm\fR| \fBs\fR
644 where \fIn\fR is a number of units, and the tags \fBd\fR, \fBh\fR, \fBm\fR, and
645 \fBs\fR stand for days, hours, minutes and seconds, respectively. An offset is
646 relative to the starting time. Thus, this form can only be used with the
647 \fB-b\fR option.
648 .RE
650 .sp
651 .ne 2
652 .na
653 \fB\fIevent\fR\fR
654 .ad
655 .sp .6
656 .RS 4n
657 The literal string or ordinal event number as found in \fBaudit_event\fR(4). If
658 \fIevent\fR is not found in the \fBaudit_event\fR file it is considered
659 invalid.
660 .RE
662 .sp
663 .ne 2
664 .na
665 \fB\fIgroup\fR\fR
666 .ad
667 .sp .6
668 .RS 4n
669 The literal string or ordinal group ID number as found in \fBgroup\fR(4). If
670 \fIgroup\fR is not found in the \fBgroup\fR file it is considered invalid.
671 \fIgroup\fR can be negative.
672 .RE
674 .sp
675 .ne 2
676 .na
677 \fB\fIlabel\fR\fR
678 .ad
679 .sp .6
680 .RS 4n
681 The literal string representation of a MAC label or a range of two valid MAC
682 labels. To specify a range, use \fBx;y\fR where \fBx\fR and \fBy\fR are valid
683 MAC labels. Only those records that are fully bounded by \fBx\fR and \fBy\fR
684 will be selected. If \fBx\fR or \fBy\fR is omitted, the default uses
685 \fBADMIN_LOW\fR or \fBADMIN_HIGH\fR respectively. Notice that quotes must be
686 used when specifying a range.
687 .RE
689 .sp
690 .ne 2
691 .na
692 \fB\fIpathname\fR\fR
693 .ad
694 .sp .6
695 .RS 4n
696 A regular expression describing a pathname.
697 .RE
699 .sp
700 .ne 2
701 .na
702 \fB\fIuser\fR\fR
703 .ad
704 .sp .6
705 .RS 4n
706 The literal username or ordinal user ID number as found in \fBpasswd\fR(4). If
707 the username is not found in the \fBpasswd\fR file it is considered invalid.
708 \fIuser\fR can be negative.
709 .RE
711 .SH EXAMPLES
712 .LP
713 \fBExample 1 \fRThe auditreduce command
714 .sp
715 .LP
716 \fBpraudit\fR(1M) is available to display audit records in a human-readable
717 form.
719 .sp
720 .LP
721 This will display the entire audit trail in a human-readable form:
723 .sp
724 .in +2
725 .nf
726 % auditreduce | praudit
727 .fi
728 .in -2
729 .sp
731 .sp
732 .LP
733 If all the audit trail files are being combined into one large file, then
734 deleting the original files could be desirable to prevent the records from
735 appearing twice:
737 .sp
738 .in +2
739 .nf
740 % auditreduce -V -D /etc/security/audit/combined/all
741 .fi
742 .in -2
743 .sp
745 .sp
746 .LP
747 This displays what user \fBmilner\fR did on April 13, 1988. The output is
748 displayed in a human-readable form to the standard output:
750 .sp
751 .in +2
752 .nf
753 % auditreduce -d 19880413 -u milner | praudit
754 .fi
755 .in -2
756 .sp
758 .sp
759 .LP
760 The above example might produce a large volume of data if \fBmilner\fR has been
761 busy. Perhaps looking at only login and logout times would be simpler. The
762 \fB-c\fR option will select records from a specified class:
764 .sp
765 .in +2
766 .nf
767 % auditreduce -d 19880413 -u milner -c lo | praudit
768 .fi
769 .in -2
770 .sp
772 .sp
773 .LP
774 To see \fBmilner\fR's login/logout activity for April 13, 14, and 15, the
775 following is used. The results are saved to a file in the current working
776 directory. Notice that the name of the output file will have \fBmilnerlo\fR as
777 the \fIsuffix\fR, with the appropriate timestamp prefixes. Notice also that the
778 long form of the name is used for the \fB-c\fR option:
780 .sp
781 .in +2
782 .nf
783 % auditreduce -a 19880413 -b +3d -u milner -c login_logout -O milnerlo
784 .fi
785 .in -2
786 .sp
788 .sp
789 .LP
790 To follow \fBmilner\fR's movement about the file system on April 13, 14, and 15
791 the \fBchdir\fR record types could be viewed. Notice that in order to get the
792 same time range as the above example we needed to specify the \fB-b\fR time as
793 the day \fBafter\fR our range. This is because \fB19880416\fR defaults to
794 midnight of that day, and records before that fall on \fB0415\fR, the end-day
795 of the range.
797 .sp
798 .in +2
799 .nf
800 % auditreduce -a 19880413 -b 19880416 -u milner -m AUE_CHDIR | praudit
801 .fi
802 .in -2
803 .sp
805 .sp
806 .LP
807 In this example, the audit records are being collected in summary form (the
808 login/logout records only). The records are being written to a summary file in
809 a different directory than the normal audit root to prevent the selected
810 records from existing twice in the audit root.
812 .sp
813 .in +2
814 .nf
815 % auditreduce -d 19880330 -c lo -O /etc/security/audit_summary/logins
816 .fi
817 .in -2
818 .sp
820 .sp
821 .LP
822 If activity for user \fBID\fR 9944 has been observed, but that user is not
823 known to the system administrator, then the command in the following example
824 searches the entire audit trail for any records generated by that user.
825 \fBauditreduce\fR queries the system about the current validity of \fBID\fR
826 9944 and displays a warning message if it is not currently active:
828 .sp
829 .in +2
830 .nf
831 % auditreduce -O /etc/security/audit_suspect/user9944 -u 9944
832 .fi
833 .in -2
834 .sp
836 .sp
837 .LP
838 To get an audit log of only the global zone:
840 .sp
841 .in +2
842 .nf
843 % auditreduce -z global
844 .fi
845 .in -2
847 .SH FILES
848 .sp
849 .ne 2
850 .na
851 \fB\fB/etc/security/audit/\fR\fIserver\fR\fB/files/*\fR\fR
852 .ad
853 .sp .6
854 .RS 4n
855 location of audit trails, when stored
856 .RE
858 .SH ATTRIBUTES
859 .sp
860 .LP
861 See \fBattributes\fR(5) for descriptions of the following attributes:
862 .sp
864 .sp
865 .TS
866 box;
867 c | c
868 l | l .
869 ATTRIBUTE TYPE ATTRIBUTE VALUE
870 _
871 Interface Stability See below.
872 .TE
874 .sp
875 .LP
876 The command invocation is Stable. The binary file format is Stable. The binary
877 file contents is Unstable.
878 .SH SEE ALSO
879 .sp
880 .LP
881 \fBbsmconv\fR(1M), \fBpraudit\fR(1M), \fBaudit.log\fR(4), \fBaudit_class\fR(4),
882 \fBaudit_control\fR(4), \fBgroup\fR(4), \fBhosts\fR(4), \fBpasswd\fR(4),
883 \fBattributes\fR(5), \fBsmf\fR(5)
884 .sp
885 .LP
886 See the section on Solaris Auditing in \fISystem Administration Guide: Security
887 Services\fR.
888 .SH DIAGNOSTICS
889 .sp
890 .LP
891 \fBauditreduce\fR displays error messages if there are command line errors and
892 then exits. If there are fatal errors during the run, \fBauditreduce\fR
893 displays an explanatory message and exits. In this case, the output file might
894 be in an inconsistent state (no trailer or partially written record) and
895 \fBauditreduce\fR displays a warning message before exiting. Successful
896 invocation returns \fB0\fR and unsuccessful invocation returns \fB1\fR.
897 .sp
898 .LP
899 Since \fBauditreduce\fR might be processing a large number of input files, it
900 is possible that the machine-wide limit on open files will be exceeded. If this
901 happens, \fBauditreduce\fR displays a message to that effect, give information
902 on how many file there are, and exit.
903 .sp
904 .LP
905 If \fBauditreduce\fR displays a record's timestamp in a diagnostic message,
906 that time is in local time. However, when filenames are displayed, their
907 timestamps are in \fBGMT\fR.
908 .SH BUGS
909 .sp
910 .LP
911 Conjunction, disjunction, negation, and grouping of record selection options
912 should be allowed.
913 .SH NOTES
914 .sp
915 .LP
916 The functionality described in this man page is available only if the Solaris
917 Auditing has been enabled. See \fBbsmconv\fR(1M) for more information.
918 .sp
919 .LP
920 The \fB-z\fR option should be used only if the audit policy \fBzonename\fR is
921 set. If there is no zonename token, then no records will be selected.