| blob | d7b854ee1b191b1c39bebbe9083052d6bd014892 |
1 '\" te
2 .\" Copyright (c) 2006 Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH AUDITREDUCE 1M "Apr 10, 2006"
7 .SH NAME
8 auditreduce \- merge and select audit records from audit trail files
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBauditreduce\fR [\fIoptions\fR] [\fIaudit-trail-file\fR]...
13 .fi
15 .SH DESCRIPTION
16 .sp
17 .LP
18 \fBauditreduce\fR allows you to select or merge records from audit trail files.
19 Audit files can be from one or more machines.
20 .sp
21 .LP
22 The merge function merges together audit records from one or more input audit
23 trail files into a single output file. The records in an audit trail file are
24 assumed to be sorted in chronological order (oldest first) and this order is
25 maintained by \fBauditreduce\fR in the output file.
26 .sp
27 .LP
28 Unless instructed otherwise, \fBauditreduce\fR will merge the entire audit
29 trail, which consists of all the audit trail files in the directory structure
30 \fIaudit_root_dir\fR/*/files (see \fBaudit_control\fR(4) for details of the
31 structure of the audit root). Unless specified with the -\fBR\fR or -\fBS\fR
32 option, \fIaudit_root_dir\fR defaults to \fB/etc/security/audit\fR. By using
33 the file selection options it is possible to select some subset of these files,
34 or files from another directory, or files named explicitly on the command line.
35 .sp
36 .LP
37 The select function allows audit records to be selected on the basis of
38 numerous criteria relating to the record's content (see \fBaudit.log\fR(4) for
39 details of record content). A record must meet all of the
40 \fIrecord-selection-option\fR criteria to be selected.
41 .SS "Audit Trail Filename Format"
42 .sp
43 .LP
44 Any audit trail file not named on the command line must conform to the audit
45 trail filename format. Files produced by the audit system already have this
46 format. Output file names produced by \fBauditreduce\fR are in this format. It
47 is:
48 .sp
49 .in +2
50 .nf
51 \fIstart-time\fR\fB\&.\fR\fI\|end-time\fR\fB\&.\fR\fI\|suffix\fR
52 .fi
53 .in -2
54 .sp
56 .sp
57 .LP
58 where \fIstart-time\fR is the 14-character timestamp of when the file was
59 opened, \fIend-time\fR is the 14-character timestamp of when the file was
60 closed, and \fIsuffix\fR is the name of the machine which generated the audit
61 trail file, or some other meaningful suffix (for example, \fBall\fR, if the
62 file contains a combined group of records from many machines). The
63 \fIend-time\fR can be the literal string \fBnot_terminated\fR, to indicate that
64 the file is still being written to by the audit system. Timestamps are of the
65 form \fIyyyymmddhhmmss\fR (year, month, day, hour, minute, second). The
66 timestamps are in Greenwich Mean Time (GMT).
67 .SH OPTIONS
68 .SS "File Selection Options"
69 .sp
70 .LP
71 The file selection options indicate which files are to be processed and certain
72 types of special treatment.
73 .sp
74 .ne 2
75 .na
76 \fB\fB-A\fR\fR
77 .ad
78 .sp .6
79 .RS 4n
80 All of the records from the input files will be selected regardless of their
81 timestamp. This option effectively disables the \fB-a\fR, \fB-b\fR, and
82 \fB-d\fR options. This is useful in preventing the loss of records if the
83 \fB-D\fR option is used to delete the input files after they are processed.
84 Note, however, that if a record is \fInot\fR selected due to another option,
85 then \fB-A\fR will not override that.
86 .RE
88 .sp
89 .ne 2
90 .na
91 \fB\fB-C\fR\fR
92 .ad
93 .sp .6
94 .RS 4n
95 Only process complete files. Files whose filename \fIend-time\fR timestamp is
96 \fBnot_terminated\fR are not processed (such a file is currently being written
97 to by the audit system). This is useful in preventing the loss of records if
98 \fB-D\fR is used to delete the input files after they are processed. It does
99 not apply to files specified on the command line.
100 .RE
102 .sp
103 .ne 2
104 .na
105 \fB\fB-D\fR \fIsuffix\fR\fR
106 .ad
107 .sp .6
108 .RS 4n
109 Delete input files after they are read if the entire run is successful. If
110 \fBauditreduce\fR detects an error while reading a file, then that file is not
111 deleted. If \fB-D\fR is specified, \fB-A\fR, \fB-C\fR and \fB-O\fR are also
112 implied. \fIsuffix\fR is given to the \fB-O\fR option. This helps prevent the
113 loss of audit records by ensuring that all of the records are written, only
114 complete files are processed, and the records are written to a file before
115 being deleted. Note that if both \fB-D\fR and \fB-O\fR are specified in the
116 command line, the order of specification is significant. The \fIsuffix\fR
117 associated with the latter specification is in effect.
118 .RE
120 .sp
121 .ne 2
122 .na
123 \fB\fB-M\fR \fImachine\fR\fR
124 .ad
125 .sp .6
126 .RS 4n
127 Allows selection of records from files with \fImachine\fR as the filename
128 suffix. If \fB-M\fR is not specified, all files are processed regardless of
129 suffix. \fB-M\fR can also be used to allow selection of records from files that
130 contain combined records from many machines and have a common suffix (such as
131 \fBall\fR).
132 .RE
134 .sp
135 .ne 2
136 .na
137 \fB\fB-N\fR\fR
138 .ad
139 .sp .6
140 .RS 4n
141 Select objects in \fBnew mode\fR.This flag is off by default, thus retaining
142 backward compatibility. In the existing, \fBold mode\fR, specifying the
143 \fB-e\fR, \fB-f\fR, \fB-g\fR, \fB-r\fR, or \fB-u\fR flags would select not only
144 actions taken with those \fBID\fRs, but also certain objects owned by those
145 \fBID\fRs. When running in \fBnew mode\fR, only actions are selected. In order
146 to select objects, the \fB-o\fR option must be used.
147 .RE
149 .sp
150 .ne 2
151 .na
152 \fB\fB-O\fR \fIsuffix\fR\fR
153 .ad
154 .sp .6
155 .RS 4n
156 Direct output stream to a file in the current \fBaudit_root_dir\fR with the
157 indicated suffix. \fIsuffix\fR can alternatively contain a full pathname, in
158 which case the last component is taken as the suffix, ahead of which the
159 timestamps will be placed, ahead of which the remainder of the pathname will be
160 placed. If the \fB-O\fR option is not specified, the output is sent to the
161 standard output. When \fBauditreduce\fR places timestamps in the filename, it
162 uses the times of the first and last records in the merge as the
163 \fIstart-time\fR and \fIend-time\fR.
164 .RE
166 .sp
167 .ne 2
168 .na
169 \fB\fB-Q\fR\fR
170 .ad
171 .sp .6
172 .RS 4n
173 Quiet. Suppress notification about errors with input files.
174 .RE
176 .sp
177 .ne 2
178 .na
179 \fB\fB-R\fR \fIpathname\fR\fR
180 .ad
181 .sp .6
182 .RS 4n
183 Specify the pathname of an alternate audit root directory \fIaudit_root_dir\fR
184 to be \fIpathname\fR. Therefore, rather than using
185 \fB/etc/security/audit\fR/*/files by default, \fIpathname\fR/*/files will be
186 examined instead.
187 .LP
188 Note -
189 .sp
190 .RS 2
191 The root file system of any non-global zones must not be referenced with the
192 \fB-R\fR option. Doing so might damage the global zone's file system, might
193 compromise the security of the global zone, and might damage the non-global
194 zone's file system. See \fBzones\fR(5).
195 .RE
196 .RE
198 .sp
199 .ne 2
200 .na
201 \fB\fB-S\fR \fIserver\fR\fR
202 .ad
203 .sp .6
204 .RS 4n
205 This option causes \fBauditreduce\fR to read audit trail files from a specific
206 location (server directory). \fIserver\fR is normally interpreted as the name
207 of a subdirectory of the audit root, therefore \fBauditreduce\fR will look in
208 \fIaudit_root_dir\fR/\fIserver\fR/files for the audit trail files. But if
209 \fIserver\fR contains any `\fB/\fR' characters, it is the name of a specific
210 directory not necessarily contained in the audit root. In this case,
211 \fIserver\fR/files will be consulted. This option allows archived files to be
212 manipulated easily, without requiring that they be physically located in a
213 directory structure like that of \fB/etc/security/audit\fR.
214 .RE
216 .sp
217 .ne 2
218 .na
219 \fB\fB-V\fR\fR
220 .ad
221 .sp .6
222 .RS 4n
223 Verbose. Display the name of each file as it is opened, and how many records
224 total were written to the output stream.
225 .RE
227 .SS "Record Selection Options"
228 .sp
229 .LP
230 The record selection options listed below are used to indicate which records
231 are written to the output file produced by \fBauditreduce\fR.
232 .sp
233 .LP
234 Multiple arguments of the same type are not permitted.
235 .sp
236 .ne 2
237 .na
238 \fB\fB-a\fR \fIdate-time\fR\fR
239 .ad
240 .sp .6
241 .RS 4n
242 Select records that occurred at or after \fIdate-time\fR. The \fIdate-time\fR
243 argument is described under \fBOption Arguments\fR, below. \fIdate-time\fR is
244 in local time. The \fB-a\fR and \fB-b\fR options can be used together to form a
245 range.
246 .RE
248 .sp
249 .ne 2
250 .na
251 \fB\fB-b\fR \fIdate-time\fR\fR
252 .ad
253 .sp .6
254 .RS 4n
255 Select records that occurred before \fIdate-time\fR.
256 .RE
258 .sp
259 .ne 2
260 .na
261 \fB\fB-c\fR \fIaudit-classes\fR\fR
262 .ad
263 .sp .6
264 .RS 4n
265 Select records by audit class. Records with events that are mapped to the audit
266 classes specified by \fIaudit-classes\fR are selected. Audit class names are
267 defined in \fBaudit_class\fR(4). The \fIaudit-classes\fR can be a comma
268 separated list of \fBaudit\fR \fIflags\fR like those described in
269 \fBaudit_control\fR(4). Using the \fBaudit\fR \fIflags,\fR one can select
270 records based upon success and failure criteria.
271 .RE
273 .sp
274 .ne 2
275 .na
276 \fB\fB-d\fR \fIdate-time\fR\fR
277 .ad
278 .sp .6
279 .RS 4n
280 Select records that occurred on a specific day (a 24-hour period beginning at
281 00:00:00 of the day specified and ending at 23:59:59). The day specified is in
282 local time. The time portion of the argument, if supplied, is ignored. Any
283 records with timestamps during that day are selected. If any hours, minutes, or
284 seconds are given in \fItime,\fR they are ignored. \fB-d\fR can not be used
285 with \fB-a\fR or \fB\fR\fB-b\fR\fB\&.\fR
286 .RE
288 .sp
289 .ne 2
290 .na
291 \fB\fB-e\fR \fIeffective-user\fR\fR
292 .ad
293 .sp .6
294 .RS 4n
295 Select records with the specified \fIeffective-user.\fR
296 .RE
298 .sp
299 .ne 2
300 .na
301 \fB\fB-f\fR \fIeffective-group\fR\fR
302 .ad
303 .sp .6
304 .RS 4n
305 Select records with the specified \fIeffective-group.\fR
306 .RE
308 .sp
309 .ne 2
310 .na
311 \fB\fB-g\fR \fIreal-group\fR\fR
312 .ad
313 .sp .6
314 .RS 4n
315 Select records with the specified \fIreal-group.\fR
316 .RE
318 .sp
319 .ne 2
320 .na
321 \fB\fB-j\fR \fIsubject-ID\fR\fR
322 .ad
323 .sp .6
324 .RS 4n
325 Select records with the specified \fIsubject-ID\fR where \fIsubject-ID\fR is a
326 process ID.
327 .RE
329 .sp
330 .ne 2
331 .na
332 \fB\fB-l\fR \fIlabel\fR\fR
333 .ad
334 .sp .6
335 .RS 4n
336 Select records with the specified label (or label range), as explained under
337 "Option Arguments," below. This option is available only if the system is
338 configured with Trusted Extensions.
339 .RE
341 .sp
342 .ne 2
343 .na
344 \fB\fB-m\fR \fIevent\fR\fR
345 .ad
346 .sp .6
347 .RS 4n
348 Select records with the indicated \fIevent\fR. The \fIevent\fR is the literal
349 string or the \fIevent\fR number.
350 .RE
352 .sp
353 .ne 2
354 .na
355 \fB\fB-o\fR \fIobject_type=objectID_value\fR\fR
356 .ad
357 .sp .6
358 .RS 4n
359 Select records by object type. A match occurs when the record contains the
360 information describing the specified \fIobject_type\fR and the object ID equals
361 the value specified by \fIobjectID_value.\fR The allowable object types and
362 values are as follows:
363 .sp
364 .ne 2
365 .na
366 \fBfile=\fIpathname\fR\fR
367 .ad
368 .sp .6
369 .RS 4n
370 Select records containing file system objects with the specified pathname,
371 where pathname is a comma separated list of regular expressions. If a regular
372 expression is preceded by a tilde (\fB~\fR), files matching the expression are
373 excluded from the output. For example, the option
374 \fBfile=~/usr/openwin,/usr,/etc\fR would select all files in \fB/usr\fR or
375 \fB/etc\fR except those in \fB/usr/openwin\fR. The order of the regular
376 expressions is important because auditreduce processes them from left to right,
377 and stops when a file is known to be either selected or excluded. Thus the
378 option \fBfile=\fR \fB/usr\fR, \fB/etc\fR, \fB~/usr/openwin\fR would select all
379 files in \fB/usr\fR and all files in \fB/etc\fR. Files in \fB/usr/openwin\fR
380 are not excluded because the regular expression \fB/usr\fR is matched first.
381 Care should be given in surrounding the \fIpathname\fR with quotes so as to
382 prevent the shell from expanding any tildes.
383 .RE
385 .sp
386 .ne 2
387 .na
388 \fBfilegroup\fI=group\fR\fR
389 .ad
390 .sp .6
391 .RS 4n
392 Select records containing file system objects with \fIgroup\fR as the owning
393 group.
394 .RE
396 .sp
397 .ne 2
398 .na
399 \fBfileowner=\fIuser\fR\fR
400 .ad
401 .sp .6
402 .RS 4n
403 Select records containing file system objects with \fIuser\fR as the owning
404 user.
405 .RE
407 .sp
408 .ne 2
409 .na
410 \fBmsgqid=\fIID\fR\fR
411 .ad
412 .sp .6
413 .RS 4n
414 Select records containing message queue objects with the specified \fIID\fR
415 where \fIID\fR is a message queue \fBID\fR.
416 .RE
418 .sp
419 .ne 2
420 .na
421 \fBmsgqgroup=\fIgroup\fR\fR
422 .ad
423 .sp .6
424 .RS 4n
425 Select records containing message queue objects with \fIgroup\fR as the owning
426 or creating group.
427 .RE
429 .sp
430 .ne 2
431 .na
432 \fBmsgqowner=\fIuser\fR\fR
433 .ad
434 .sp .6
435 .RS 4n
436 Select records containing message queue objects with \fIuser\fR as the owning
437 or creating user.
438 .RE
440 .sp
441 .ne 2
442 .na
443 \fBpid=\fIID\fR\fR
444 .ad
445 .sp .6
446 .RS 4n
447 Select records containing process objects with the specified \fIID\fR where
448 \fIID\fR is a process \fBID\fR. Process are objects when they are receivers of
449 signals.
450 .RE
452 .sp
453 .ne 2
454 .na
455 \fBprocgroup=\fIgroup\fR\fR
456 .ad
457 .sp .6
458 .RS 4n
459 Select records containing process objects with \fIgroup\fR as the real or
460 effective group.
461 .RE
463 .sp
464 .ne 2
465 .na
466 \fBprocowner=\fIuser\fR\fR
467 .ad
468 .sp .6
469 .RS 4n
470 Select records containing process objects with \fIuser\fR as the real or
471 effective user.
472 .RE
474 .sp
475 .ne 2
476 .na
477 \fBsemid=\fIID\fR\fR
478 .ad
479 .sp .6
480 .RS 4n
481 Select records containing semaphore objects with the specified \fIID\fR where
482 \fIID\fR is a semaphore \fBID\fR.
483 .RE
485 .sp
486 .ne 2
487 .na
488 \fBsemgroup=\fIgroup\fR\fR
489 .ad
490 .sp .6
491 .RS 4n
492 Select records containing semaphore objects with \fIgroup\fR as the owning or
493 creating group.
494 .RE
496 .sp
497 .ne 2
498 .na
499 \fBsemowner=\fIuser\fR\fR
500 .ad
501 .sp .6
502 .RS 4n
503 Select records containing semaphore objects with \fIuser\fR as the owning or
504 creating user.
505 .RE
507 .sp
508 .ne 2
509 .na
510 \fBshmid=\fIID\fR\fR
511 .ad
512 .sp .6
513 .RS 4n
514 Select records containing shared memory objects with the specified \fIID\fR
515 where \fIID\fR is a shared memory \fBID\fR.
516 .RE
518 .sp
519 .ne 2
520 .na
521 \fBshmgroup=\fIgroup\fR\fR
522 .ad
523 .sp .6
524 .RS 4n
525 Select records containing shared memory objects with \fIgroup\fR as the owning
526 or creating group.
527 .RE
529 .sp
530 .ne 2
531 .na
532 \fBshmowner=\fIuser\fR\fR
533 .ad
534 .sp .6
535 .RS 4n
536 Select records containing shared memory objects with \fIuser\fR as the owning
537 or creating user.
538 .RE
540 .sp
541 .ne 2
542 .na
543 \fBsock=\fIport_number|machine\fR\fR
544 .ad
545 .sp .6
546 .RS 4n
547 Select records containing socket objects with the specified \fIport_number\fR
548 or the specified \fImachine\fR where \fImachine\fR is a machine name as defined
549 in \fBhosts\fR(4).
550 .RE
552 .sp
553 .ne 2
554 .na
555 \fBfmri=\fIservice instance\fR\fR
556 .ad
557 .sp .6
558 .RS 4n
559 Select records containing fault management resource identifier (FMRI) objects
560 with the specified \fIservice instance\fR. See \fBsmf\fR(5).
561 .RE
563 .RE
565 .sp
566 .ne 2
567 .na
568 \fB\fB-r\fR \fIreal-user\fR\fR
569 .ad
570 .sp .6
571 .RS 4n
572 Select records with the specified \fIreal-user\fR.
573 .RE
575 .sp
576 .ne 2
577 .na
578 \fB\fB-s\fR \fIsession-id\fR\fR
579 .ad
580 .sp .6
581 .RS 4n
582 Select audit records with the specified \fIsession-id\fR.
583 .RE
585 .sp
586 .ne 2
587 .na
588 \fB\fB-u\fR \fIaudit-user\fR\fR
589 .ad
590 .sp .6
591 .RS 4n
592 Select records with the specified \fIaudit-user\fR.
593 .RE
595 .sp
596 .ne 2
597 .na
598 \fB\fB-z\fR \fIzone-name\fR\fR
599 .ad
600 .sp .6
601 .RS 4n
602 Select records from the specified zone name. The zone name selection is
603 case-sensitive.
604 .RE
606 .sp
607 .LP
608 When one or more \fIfilename\fR arguments appear on the command line, only the
609 named files are processed. Files specified in this way need not conform to the
610 audit trail filename format. However, \fB-M\fR, \fB-S\fR, and \fB-R\fR must not
611 be used when processing named files. If the \fIfilename\fR is ``\(mi'' then the
612 input is taken from the standard input.
613 .SS "Option Arguments"
614 .sp
615 .ne 2
616 .na
617 \fB\fIaudit-trail-file\fR\fR
618 .ad
619 .sp .6
620 .RS 4n
621 An audit trail file as defined in \fBaudit.log\fR(4). An audit trail file not
622 named on the command line must conform to the audit trail file name format.
623 Audit trail files produced as output of \fBauditreduce\fR are in this format as
624 well. The format is:
625 .sp
626 \fIstart-time . \|end-time . \|suffix\fR
627 .sp
628 \fIstart-time\fR is the 14 character time stamp denoting when the file was
629 opened. \fIend-time\fR is the 14 character time stamp denoting when the file
630 was closed. \fIend-time\fR can also be the literal string \fBnot_terminated\fR,
631 indicating the file is still be written to by the audit daemon or the file was
632 not closed properly (a system crash or abrupt halt occurred). \fIsuffix\fR is
633 the name of the machine that generated the audit trail file (or some other
634 meaningful suffix; for example, \fBall\fR would be a good suffix if the audit
635 trail file contains a combined group of records from many machines).
636 .RE
638 .sp
639 .ne 2
640 .na
641 \fB\fIdate-time\fR\fR
642 .ad
643 .sp .6
644 .RS 4n
645 The \fIdate-time\fR argument to \fB-a\fR, \fB-b\fR, and \fB-d\fR can be of two
646 forms: An absolute \fIdate-time\fR takes the form:
647 .sp
648 \fI\fR yyyymmdd [ \fIhh\fR [ \fImm\fR [ \fIss\fR ]]]
649 .sp
650 where \fIyyyy\fR specifies a year (with 1970 as the earliest value), \fImm\fR
651 is the month (01-12), \fBdd\fR is the day (01-31), \fIhh\fR is the hour
652 (00-23), \fImm\fR is the minute (00-59), and \fIss\fR is the second (00-59).
653 The default is 00 for \fIhh\fR, \fImm\fR and \fIss\fR.
654 .sp
655 An offset can be specified as: \fB+\fR\fIn\fR \fBd\fR|\fBh\fR|\fBm\fR| \fBs\fR
656 where \fIn\fR is a number of units, and the tags \fBd\fR, \fBh\fR, \fBm\fR, and
657 \fBs\fR stand for days, hours, minutes and seconds, respectively. An offset is
658 relative to the starting time. Thus, this form can only be used with the
659 \fB-b\fR option.
660 .RE
662 .sp
663 .ne 2
664 .na
665 \fB\fIevent\fR\fR
666 .ad
667 .sp .6
668 .RS 4n
669 The literal string or ordinal event number as found in \fBaudit_event\fR(4). If
670 \fIevent\fR is not found in the \fBaudit_event\fR file it is considered
671 invalid.
672 .RE
674 .sp
675 .ne 2
676 .na
677 \fB\fIgroup\fR\fR
678 .ad
679 .sp .6
680 .RS 4n
681 The literal string or ordinal group ID number as found in \fBgroup\fR(4). If
682 \fIgroup\fR is not found in the \fBgroup\fR file it is considered invalid.
683 \fIgroup\fR can be negative.
684 .RE
686 .sp
687 .ne 2
688 .na
689 \fB\fIlabel\fR\fR
690 .ad
691 .sp .6
692 .RS 4n
693 The literal string representation of a MAC label or a range of two valid MAC
694 labels. To specify a range, use \fBx;y\fR where \fBx\fR and \fBy\fR are valid
695 MAC labels. Only those records that are fully bounded by \fBx\fR and \fBy\fR
696 will be selected. If \fBx\fR or \fBy\fR is omitted, the default uses
697 \fBADMIN_LOW\fR or \fBADMIN_HIGH\fR respectively. Notice that quotes must be
698 used when specifying a range.
699 .RE
701 .sp
702 .ne 2
703 .na
704 \fB\fIpathname\fR\fR
705 .ad
706 .sp .6
707 .RS 4n
708 A regular expression describing a pathname.
709 .RE
711 .sp
712 .ne 2
713 .na
714 \fB\fIuser\fR\fR
715 .ad
716 .sp .6
717 .RS 4n
718 The literal username or ordinal user ID number as found in \fBpasswd\fR(4). If
719 the username is not found in the \fBpasswd\fR file it is considered invalid.
720 \fIuser\fR can be negative.
721 .RE
723 .SH EXAMPLES
724 .LP
725 \fBExample 1 \fRThe auditreduce command
726 .sp
727 .LP
728 \fBpraudit\fR(1M) is available to display audit records in a human-readable
729 form.
731 .sp
732 .LP
733 This will display the entire audit trail in a human-readable form:
735 .sp
736 .in +2
737 .nf
738 % auditreduce | praudit
739 .fi
740 .in -2
741 .sp
743 .sp
744 .LP
745 If all the audit trail files are being combined into one large file, then
746 deleting the original files could be desirable to prevent the records from
747 appearing twice:
749 .sp
750 .in +2
751 .nf
752 % auditreduce -V -D /etc/security/audit/combined/all
753 .fi
754 .in -2
755 .sp
757 .sp
758 .LP
759 This displays what user \fBmilner\fR did on April 13, 1988. The output is
760 displayed in a human-readable form to the standard output:
762 .sp
763 .in +2
764 .nf
765 % auditreduce -d 19880413 -u milner | praudit
766 .fi
767 .in -2
768 .sp
770 .sp
771 .LP
772 The above example might produce a large volume of data if \fBmilner\fR has been
773 busy. Perhaps looking at only login and logout times would be simpler. The
774 \fB-c\fR option will select records from a specified class:
776 .sp
777 .in +2
778 .nf
779 % auditreduce -d 19880413 -u milner -c lo | praudit
780 .fi
781 .in -2
782 .sp
784 .sp
785 .LP
786 To see \fBmilner\fR's login/logout activity for April 13, 14, and 15, the
787 following is used. The results are saved to a file in the current working
788 directory. Notice that the name of the output file will have \fBmilnerlo\fR as
789 the \fIsuffix\fR, with the appropriate timestamp prefixes. Notice also that the
790 long form of the name is used for the \fB-c\fR option:
792 .sp
793 .in +2
794 .nf
795 % auditreduce -a 19880413 -b +3d -u milner -c login_logout -O milnerlo
796 .fi
797 .in -2
798 .sp
800 .sp
801 .LP
802 To follow \fBmilner\fR's movement about the file system on April 13, 14, and 15
803 the \fBchdir\fR record types could be viewed. Notice that in order to get the
804 same time range as the above example we needed to specify the \fB-b\fR time as
805 the day \fBafter\fR our range. This is because \fB19880416\fR defaults to
806 midnight of that day, and records before that fall on \fB0415\fR, the end-day
807 of the range.
809 .sp
810 .in +2
811 .nf
812 % auditreduce -a 19880413 -b 19880416 -u milner -m AUE_CHDIR | praudit
813 .fi
814 .in -2
815 .sp
817 .sp
818 .LP
819 In this example, the audit records are being collected in summary form (the
820 login/logout records only). The records are being written to a summary file in
821 a different directory than the normal audit root to prevent the selected
822 records from existing twice in the audit root.
824 .sp
825 .in +2
826 .nf
827 % auditreduce -d 19880330 -c lo -O /etc/security/audit_summary/logins
828 .fi
829 .in -2
830 .sp
832 .sp
833 .LP
834 If activity for user \fBID\fR 9944 has been observed, but that user is not
835 known to the system administrator, then the command in the following example
836 searches the entire audit trail for any records generated by that user.
837 \fBauditreduce\fR queries the system about the current validity of \fBID\fR
838 9944 and displays a warning message if it is not currently active:
840 .sp
841 .in +2
842 .nf
843 % auditreduce -O /etc/security/audit_suspect/user9944 -u 9944
844 .fi
845 .in -2
846 .sp
848 .sp
849 .LP
850 To get an audit log of only the global zone:
852 .sp
853 .in +2
854 .nf
855 % auditreduce -z global
856 .fi
857 .in -2
859 .SH FILES
860 .sp
861 .ne 2
862 .na
863 \fB\fB/etc/security/audit/\fR\fIserver\fR\fB/files/*\fR\fR
864 .ad
865 .sp .6
866 .RS 4n
867 location of audit trails, when stored
868 .RE
870 .SH ATTRIBUTES
871 .sp
872 .LP
873 See \fBattributes\fR(5) for descriptions of the following attributes:
874 .sp
876 .sp
877 .TS
878 box;
879 c | c
880 l | l .
881 ATTRIBUTE TYPE ATTRIBUTE VALUE
882 _
883 Interface Stability See below.
884 .TE
886 .sp
887 .LP
888 The command invocation is Stable. The binary file format is Stable. The binary
889 file contents is Unstable.
890 .SH SEE ALSO
891 .sp
892 .LP
893 \fBbsmconv\fR(1M), \fBpraudit\fR(1M), \fBaudit.log\fR(4), \fBaudit_class\fR(4),
894 \fBaudit_control\fR(4), \fBgroup\fR(4), \fBhosts\fR(4), \fBpasswd\fR(4),
895 \fBattributes\fR(5), \fBsmf\fR(5)
896 .sp
897 .LP
898 See the section on Solaris Auditing in \fISystem Administration Guide: Security
899 Services\fR.
900 .SH DIAGNOSTICS
901 .sp
902 .LP
903 \fBauditreduce\fR displays error messages if there are command line errors and
904 then exits. If there are fatal errors during the run, \fBauditreduce\fR
905 displays an explanatory message and exits. In this case, the output file might
906 be in an inconsistent state (no trailer or partially written record) and
907 \fBauditreduce\fR displays a warning message before exiting. Successful
908 invocation returns \fB0\fR and unsuccessful invocation returns \fB1\fR.
909 .sp
910 .LP
911 Since \fBauditreduce\fR might be processing a large number of input files, it
912 is possible that the machine-wide limit on open files will be exceeded. If this
913 happens, \fBauditreduce\fR displays a message to that effect, give information
914 on how many file there are, and exit.
915 .sp
916 .LP
917 If \fBauditreduce\fR displays a record's timestamp in a diagnostic message,
918 that time is in local time. However, when filenames are displayed, their
919 timestamps are in \fBGMT\fR.
920 .SH BUGS
921 .sp
922 .LP
923 Conjunction, disjunction, negation, and grouping of record selection options
924 should be allowed.
925 .SH NOTES
926 .sp
927 .LP
928 The functionality described in this man page is available only if the Solaris
929 Auditing has been enabled. See \fBbsmconv\fR(1M) for more information.
930 .sp
931 .LP
932 The \fB-z\fR option should be used only if the audit policy \fBzonename\fR is
933 set. If there is no zonename token, then no records will be selected.