AUDITREDUCE(1)

NAME
auditreduce - select records from audit trail files

SYNOPSIS
auditreduce [-A] [-a YYYYMMDD[HH[MM[SS]]]] [-b YYYYMMDD[HH[MM[SS]]]] [-c flags] [-d YYYYMMDD] [-e euid] [-f egid] [-g rgid] [-r ruid] [-u auid] [-j id] [-m event] [-o object=value] [file ...]

DESCRIPTION
The auditreduce utility selects records from the audit trail files based on the specified criteria. Matching audit records are printed to the standard output in their raw binary form. If no filename is specified, the standard input is used by default. Use the praudit utility to print the selected audit records in human-readable form. See praudit(1) for more information.

The options are as follows:

-A  Select all records.

-a YYYYMMDD[HH[MM[SS]]]
    Select records that occurred after or on the given datetime.

-b YYYYMMDD[HH[MM[SS]]]
    Select records that occurred before the given datetime.

-c flags
    Select records matching the given audit classes specified as a comma separated list of audit flags. See audit_control(5) for a description of audit flags.

-d YYYYMMDD
    Select records that occurred on a given date. This option cannot be used with -a or -b

-e euid
    Select records with the given effective user id or name.

-f egid
    Select records with the given effective group id or name.

-g rgid
    Select records with the given real group id or name.

-r ruid
    Select records with the given real user id or name.

-u auid
    Select records with the given audit id.

-j id
    Select records having a subject token with matching ID.

-m event
    Select records with the given event name or number. See audit_event(5) for a description of audit event names and numbers.

-o object=value

    file
        Select records containing the given path name. file="/usr" matches paths starting with usr. file="~/usr" matches paths not starting with usr.

    msgqid
        Select records containing the given message queue id.

    pid Select records containing the given process id.

    semid
        Select records containing the given semaphore id.

    shmid
        Select records containing the given shared memory id.

Examples

To select all records associated with effective user ID root from the audit log /var/audit/20031016184719.20031017122634:

auditreduce -e root /var/audit/20031016184719.20031017122634

To select all setlogin(2) events from that log:

auditreduce -m AUE_SETLOGIN /var/audit/20031016184719.20031017122634

SEE ALSO
audit_control(5), audit_event(5), praudit(1)