'\" te
.\" Copyright (c) 2019 Peter Tribble.
.\" Copyright (c) 2003, Sun Microsystems, Inc.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
.\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with
.\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH PRAUDIT 8 "Aug 13, 2019"
.SH NAME
praudit \- print contents of an audit trail file
.SH SYNOPSIS
.nf
\fBpraudit\fR [\fB-r|-s\fR] [\fB-lx\fR] [\fB-d\fR\fIdel\fR] [\fB-g\fR \fIfilename\fR] [\fB-p\fR \fIfilename\fR] [\fIfilename\fR]...
.fi

.SH DESCRIPTION
\fBpraudit\fR reads the listed \fIfilename\fRs (or standard input, if no
\fIfilename\fR is specified) and interprets the data as audit trail records as
defined in \fBaudit.log\fR(5). By default, times, user and group \fBID\fRs
(\fBUID\fRs and \fBGID\fRs, respectively) are converted to their \fBASCII\fR
representation. Record type and event fields are converted to their \fBASCII\fR
representation. A maximum of 100 audit files can be specified on the command
line.
.SH OPTIONS
The following options are supported:
.sp
.ne 2
.na
\fB\fB-d\fR\fIdel\fR\fR
.ad
.sp .6
.RS 4n
Use \fIdel\fR as the field delimiter instead of the default delimiter, which is
the comma. If \fIdel\fR has special meaning for the shell, it must be quoted.
The maximum size of a delimiter is three characters. The delimiter is not
meaningful and is not used when the \fB-x\fR option is specified.
.RE

.sp
.ne 2
.na
\fB\fB-l\fR\fR
.ad
.sp .6
.RS 4n
Print one line per record.
.RE

.sp
.ne 2
.na
\fB\fB-r\fR\fR
.ad
.sp .6
.RS 4n
Print records in their raw form. Times, \fBUID\fRs, \fBGID\fRs, record types,
and events are displayed as integers. This option is useful when naming
services are offline. The \fB-r\fR option and the \fB-s\fR option are
exclusive. If both are used, a format usage error message is output.
.RE

.sp
.ne 2
.na
\fB\fB-s\fR\fR
.ad
.sp .6
.RS 4n
Display records in their short form. Numeric fields' ASCII equivalents are
looked up by means of the sources specified in the \fB/etc/nsswitch.conf\fR
file (see \fBnsswitch.conf\fR(5)). All numeric fields are converted to ASCII
and then displayed. The short \fBASCII\fR representations for the record type
and event fields are used. This option and the \fB-r\fR option are exclusive.
If both are used, a format usage error message is output.
.RE

.sp
.ne 2
.na
\fB\fB-x\fR\fR
.ad
.sp .6
.RS 4n
Print records in XML form. Tags are included in the output to identify tokens
and fields within tokens. Output begins with a valid XML prolog, which includes
identification of the DTD which can be used to parse the XML.
.RE

.sp
.ne 2
.na
\fB\fB-g\fR \fIfilename\fR\fR
.ad
.sp .6
.RS 4n
Read group entries from the specified file. \fBGID\fRs referenced in the audit
files will be resolved to group names using this file. \fBGID\fRs not
referenced in the specified file will be resolved by the host system. This
option is useful when aggregating logs from multiple systems onto a single
host for analysis, allowing \fBGID\fRs to be resolved to the group names
appropriate to the source of the audit file. To do this, copy the
\fB/etc/group\fR file from the system from which the audit file originates
and use that as the argument to the \fB-g\fR flag.
.RE

.sp
.ne 2
.na
\fB\fB-p\fR \fIfilename\fR\fR
.ad
.sp .6
.RS 4n
Read passwd entries from the specified file. \fBUID\fRs referenced in the audit
files will be resolved to user names using this file. \fBUID\fRs not
referenced in the specified file will be resolved by the host system. This
option is useful when aggregating logs from multiple systems onto a single
host for analysis, allowing \fBUID\fRs to be resolved to the user names
appropriate to the source of the audit file. To do this, copy the
\fB/etc/passwd\fR file from the system from which the audit file originates
and use that as the argument to the \fB-p\fR flag.
.RE

.SH FILES
.ne 2
.na
\fB\fB/etc/security/audit_event\fR\fR
.ad
.sp .6
.RS 4n
Audit event definition and class mappings.
.RE

.sp
.ne 2
.na
\fB\fB/etc/security/audit_class\fR\fR
.ad
.sp .6
.RS 4n
Audit class definitions.
.RE

.sp
.ne 2
.na
\fB\fB/usr/share/lib/xml/dtd\fR\fR
.ad
.sp .6
.RS 4n
Directory containing the versioned DTD file referenced in XML output, for
example, \fBadt_record.dtd.1\fR.
.RE

.sp
.ne 2
.na
\fB\fB/usr/share/lib/xml/style\fR\fR
.ad
.sp .6
.RS 4n
Directory containing the versioned XSL file referenced in XML output, for
example, \fBadt_record.xsl.1\fR.
.RE

.SH ATTRIBUTES
See \fBattributes\fR(7) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	See below
.TE

.sp
.LP
The command stability is evolving. The output format is unstable.
.SH SEE ALSO
.BR audit (2),
.BR getauditflags (3BSM),
.BR getpwuid (3C),
.BR gethostbyaddr (3NSL),
.BR ethers (3SOCKET),
.BR getipnodebyaddr (3SOCKET),
.BR audit.log (5),
.BR audit_class (5),
.BR audit_event (5),
.BR group (5),
.BR nsswitch.conf (5),
.BR passwd (5),
.BR attributes (7),
.BR getent (8)