Formats bin or stream audit records to a display device or printer.
auditpr [-i inputfile ] [ -t 0 | 1 | 2 ] [ -m Message ] [ -r ] [ -v ] [ -X ][ -h field[,field]*]
The auditpr command is part of the audit subsystem. This command reads audit records, in bin or stream format, from standard input and sends formatted records to standard output.
The output format is determined by the flags that are selected. If you specify the -m flag, a message is displayed before each heading. Use the -t and -h flags to change the default header titles and fields and the -v flag to append an audit trail. The auditpr command searches the local /etc/passwd file to convert user and group IDs to names.
An example of output using default header information follows:
event login status time command
wpar name
login dick OK Fri Feb;8 14:03:57 1990 login
Global
. . . . . trail portion . . . . .
For examples of audit trails, see the /etc/security/audit/events file where audit trail formats are defined.
Invalid records are skipped when possible, and an error message is issued. If the command cannot recover from an error, processing stops.
Item | Description |
---|---|
-h field[,field]* | Selects the fields to display and the order in which to display
them, by default e, l, R, t, and c. You
can specify the following values:
|
-i inputfile | Indicates the path to the audit trail file. If the -i flag is not specified, the auditpr command reads data from stdin. |
-m "Message" | Specifies a Message to be displayed with each heading. You must enclose the Message string in double quotation marks. |
-r | Suppresses ID translation to the symbolic name. |
-t {0 | 1 | 2} | Specifies when header titles are displayed. The default title
consists of an optional message (see the -m flag) followed by the
name of each column of output.
|
-v | Displays the trail of each audit record, using the format specifications in the /etc/security/audit/events file. |
-X | Prints long user names at the end of the audit record when the -X flag is used with other flags that display the user names. The upper limit is determined by the max_logname Object Data Manager (ODM) attribute in the PdAt and CuAt object classes. If a user name is greater than the max_logname attribute, it is truncated to the number of characters minus 1 character, which is specified by the max_logname attribute. |
Access Control
This command should grant execute (x) access to the root user and members of the audit group. The command should be setuid to the root user and have the trusted computing base attribute.
Files Accessed
Mode | File |
---|---|
r | /etc/security/audit/events |
r | /etc/passwd |
r | /etc/group |
Attention RBAC users and Trusted AIX® users: This command can perform privileged operations. Only privileged users can run privileged operations. For more information about authorizations and privileges, see Privileged Command Database in Security. For a list of privileges and the authorizations associated with this command, see the lssecattr command or the getcmdattr subcommand.
/usr/sbin/auditpr -v < /audit/trail
The /audit/trail file must contain valid audit bins or records./usr/sbin/auditselect -e"login == witte"\
/audit/trail | auditpr -v
/usr/sbin/auditstream | /usr/sbin/auditpr -t0 -heRl
Item | Description |
---|---|
/usr/sbin/auditpr | Specifies the path of the auditpr command. |
/etc/security/audit/config | Contains audit system configuration information. |
/etc/security/audit/events | Contains the audit events of the system. |
/etc/security/audit/objects | Contains audit events for audited objects (files). |
/etc/security/audit/bincmds | Contains auditbin backend commands. |
/etc/security/audit/streamcmds | Contains auditstream commands. |
/etc/security/audit/hosts | Contains the CPU ID to host name mappings. |