Filter
Top Products
showaudit(8)
System Administration 235
NAME showaudit - display the current auditing system state
SYNOPSIS showaudit
showaudit [all]
showaudit [-a users][-c classes][-e events][-g][-m][-p][-s][-t]
showaudit -h
DESCRIPTION showaudit(8) displays the current state of system auditing. When invoked without
options showaudit displays whether the writing of audit records is enabled or
disabled.
Privileges You must have auditadm or auditop privileges to run this command.
Refer to setprivileges(8) for more information.
OPTIONS The following options are supported:
-a users Displays the audit record generation policy for the specified users.
users is a comma-separated list of valid user names.
-c classes Displays the audit record generation policy for the specified audit
classes. classes is a comma-separated list of audit classes. A class
may be specified by its numeric value or its name. The ACS_
prefix may be omitted. For example, the class of audit related
events can be expressed as ACS_AUDIT, AUDIT or 2.
The following are valid classes:
all Denotes all classes
ACS_LOGIN(0) Login-related events
ACS_CONFIG(1) Configuration-related events
ACS_AUDIT(2) Audit-related events
ACS_DOMAIN(3) Domain-related events
ACS_USER(4) User management–related events
ACS_STATUS(5) Status inquiry–related events
ACS_PLATFORM(6) Platform management–related
events
ACS_SERVICE(7) Service-related events
-e events Displays the audit record generation policy for the specified audit
events. events is a comma-separated list of audit events. An event
may be specified by its numeric value or its name. The AEV_
prefix may be omitted. For example, the event for SSH login can be
expressed as AEV_LOGIN_SSH, LOGIN_SSH,or0.
See showaudit -e all for a list of all valid events.
-g Displays the global user audit record generation policy.