PRAUDIT(1)

NAME
praudit - print the contents of audit trail files

SYNOPSIS
praudit [-lrs] [-d del] [file ...]

DESCRIPTION
The praudit utility prints the contents of the audit trail files to the standard output in human-readable form. If no filename is specified, the standard input is used by default.

The options are as follows:

-l  Prints the entire record on the same line. If this option is not specified, every token is displayed on a different line.

-r  Prints the records in their raw, numeric form. This option is exclusive from -s

-s  Prints the tokens in their short form. Short text representations for record and event type are displayed. This option is exclusive from -r

-d del
    Specifies the delimeter. The default delimeter is the comma.

If the raw or short forms are not specified, the default is to print the tokens in their long form. Events are displayed as per their descriptions given in /etc/security/audit_event; uids and gids are expanded to their names; and dates and times are displayed in human-readible format.

FILES
/etc/security/audit_class
    Descriptions of audit event classes
/etc/security/audit_event
    Descriptions of audit events

SEE ALSO
audit_class(5), audit_event(5)