Filter
Top Products
viewaudit(8)
System Administration 389
NAME viewaudit - display audit records
SYNOPSIS viewaudit
viewaudit [-A date-time][-B date-time ][-c classes][-D date-time][-e events
][-i audit-ids][-l][-m del][-n][-p privilege-results][-r return-values ][-u
users][-x]
viewaudit -h
DESCRIPTION viewaudit(8) displays audit records. When invoked without options, viewaudit
displays all current local audit records. When invoked with options, viewaudit
displays only the selected records. By default, records are displayed in text format,
one token per line, with a comma as the field separator. The output can be modified
using the -l,-m del, -n,or-x option.
Privileges You must have auditadm or auditop privileges to run this command.
Refer to setprivileges(8) for more information.
OPTIONS The following options are supported:
-A date-time Selects records that occurred at or after date-time. The
date-time argument is in local time. the -A and -B options
can be used together to form a range. Valid values for
date-time are:
■ Absolute date-time : yyyymmdd[hh[mm[ss]]]
where:
■ yyyy = year (1970 is the earliest valid value)
■ mm = month (01–12)
■ dd = day (01–31)
■ hh = hour (00–23)
■ mm = minutes (00–59)
■ ss = seconds (00–59)
The default value is 00 for hh, mm, and ss.