The
praudit
utility prints the contents of the audit trail files to the standard output in
human-readable form.
If no
file
argument is specified, the standard input is used
by default.
The options are as follows:
|
| -d del
|
| |
Specifies the delimiter.
The default delimiter is the comma.
|
| -l
|
| |
Prints the entire record on the same line.
If this option is not specified,
every token is displayed on a different line.
|
| -n
|
| |
Do not convert user and group IDs to their names but leave in their
numeric forms.
|
| -p
|
| |
Specify this option if input to
praudit
is piped from the
tail(1)
utility.
This causes
praudit
to sync to the start of the next record.
|
| -r
|
| |
Prints the records in their raw, numeric form.
This option is exclusive from
-s.
|
| -s
|
| |
Prints the tokens in their short form.
Short text representations for
record and event type are displayed.
This option is exclusive from
-r.
|
| -x
|
| |
Print audit records in the XML output format.
|
|
If the raw or short forms are not specified, the default is to print the tokens
in their long form.
Events are displayed as per their descriptions given in
/etc/security/audit_event;
UIDs and GIDs are expanded to their names;
dates and times are displayed in human-readable format.
