Hallo, dies ist ein Test.

PWD: /www/data-lst1/unixsoft/unixsoft/kaempfer/.public_html

Running in File Mode
Relative path: ./../../../../../../usr/./man/man8/auditrecord.8
Real path: /usr/share/man/man8/auditrecord.8
Zurück

'\" te
.\" Copyright (c) 2007, 2021, Oracle and/or its affiliates.
.TH auditrecord 8 "21 Jun 2021" "Oracle Solaris 11.4" "System Administration Commands"
.SH NAME
auditrecord \- display Oracle Solaris audit record formats
.SH SYNOPSIS

.LP
.nf
\fB/usr/sbin/auditrecord\fR [\fB-d\fR] [ [\fB-a\fR] | [\fB-e\fR \fIstring\fR] | [\fB-c\fR \fIclass\fR] |
      [\fB-i\fR \fIid\fR] | [\fB-p\fR \fIprogramname\fR] | [\fB-s\fR \fIsystemcall\fR] | [\fB-h\fR]]
.fi
.SH DESCRIPTION
.sp
.LP
The \fBauditrecord\fR utility displays the event ID, audit class and selection mask, and record format for audit record event types defined in \fBaudit_event\fR(5). You can use \fBauditrecord\fR to generate a list of all audit record formats, or to select audit record formats based on event class, event name, generating program name, system call name, or event ID.
.sp
.LP
There are two output formats. The default format is intended for display in a terminal window; the optional HTML format is intended for viewing with a web browser.
.sp
.LP
Tokens contained in square brackets ( \fB[ ]\fR ) are optional and might not be present in every record.
.SH OPTIONS
.sp
.LP
The following options are supported:
.sp
.ne 2
.mk
.na
\fB\fB-a\fR\fR
.ad
.br
.sp .6
.RS 4n
List all audit records.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-c\fR \fIclass\fR\fR
.ad
.br
.sp .6
.RS 4n
List all the audit records selected by the list of classes, \fIclass\fR. Valid classes are found in the \fBaudit_class\fR files. For more information, see the \fBaudit_class\fR(5) man page.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-d\fR\fR
.ad
.br
.sp .6
.RS 4n
Debug mode. Display the number of audit records that are defined in \fBaudit_event\fR, the number of classes defined in \fBaudit_class\fR, any mismatches between the two files, and report which defined events do not have format information available to \fBauditrecord\fR.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-e\fR \fIstring\fR\fR
.ad
.br
.sp .6
.RS 4n
List all audit records for which the event ID label contains the string \fIstring\fR. The match is case insensitive.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-h\fR\fR
.ad
.br
.sp .6
.RS 4n
Generate the output in HTML format.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-i\fR \fIid\fR\fR
.ad
.br
.sp .6
.RS 4n
List the audit records having the numeric event ID \fIid\fR.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-p\fR \fIprogramname\fR\fR
.ad
.br
.sp .6
.RS 4n
List all audit records generated by the user-space program \fIprogramname\fR.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-s\fR \fIsystemcall\fR\fR
.ad
.br
.sp .6
.RS 4n
List all audit records generated by the system call \fIsystemcall\fR.
.RE

.sp
.LP
The \fB-p\fR and \fB-s\fR options are different names for the same thing and are mutually exclusive. The \fB-a\fR option is ignored if any of \fB-c\fR, \fB-e\fR, \fB-i\fR, \fB-p\fR, or \fB-s\fR are given. Combinations of \fB-c\fR, \fB-e\fR, \fB-i\fR, and either \fB-p\fR or \fB-s\fR are ANDed together.
.SH EXAMPLES
.LP
\fBExample 1\fR Displaying an Audit Record with a Specified Event ID

.sp
.LP
The following example shows how to display the contents of a specified audit record.

.sp
.in +2
.nf
% \fBauditrecord -i 6152\fR

terminal login
  program     /usr/sbin/login      See login(1)
              /usr/sbin/gdm        See gdm(8)
  event ID    6152                 AUE_login
  class       lo                   (0x0000000000001000)
      header
      subject
      return

.fi
.in -2
.sp
.LP
\fBExample 2\fR Displaying an Audit Record with an Event ID Label that Contains a Specified String

.sp
.LP
The following example shows how to display the contents of a audit record with an event ID label that contains the string \fBlogin\fR.

.sp
.in +2
.nf
% \fBauditrecord -e login\fR

RBAC: role login
  program     /usr/bin/su          See role login
  event ID    6173                 AUE_role_login
  class       lo                   (0x0000000000001000)
      header
      subject
      return

zone login
  program     /usr/sbin/login      See zlogin(1)
  event ID    6227                 AUE_zlogin
  class       lo                   (0x0000000000001000)
      header
      subject
      [text]                       error message
      return

[...]
.fi
.in -2
.sp
.SH EXIT STATUS
.sp
.ne 2
.mk
.na
\fB\fB0\fR\fR
.ad
.br
.sp .6
.RS 4n
Successful operation
.RE

.sp
.ne 2
.mk
.na
\fB\fBnon-zero\fR\fR
.ad
.br
.sp .6
.RS 4n
Error
.RE

.SH FILES
.sp
.ne 2
.mk
.na
\fB\fB/etc/security/audit_class\fR\fR
.ad
.br
.na
\fB\fB/etc/security/audit_class.system\fR\fR
.ad
.br
.sp .6
.RS 4n
Provides the list of valid classes and the associated audit mask.
.RE

.sp
.ne 2
.mk
.na
\fB\fB/etc/security/audit_event\fR\fR
.ad
.br
.sp .6
.RS 4n
Provides the numeric event ID, the literal event name, and the name of the associated system call or program.
.RE

.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(7) for descriptions of the following attributes:
.sp
.TS
tab(
) box;
cw(2.75i) |cw(2.75i) 
lw(2.75i) |lw(2.75i) 
.
ATTRIBUTE TYPE
ATTRIBUTE VALUE
_
Availability
system/core-os
_
CSI
Enabled
_
Interface Stability
Uncommitted
.TE
.sp
.SH SEE ALSO
.sp
.LP
\fBaudit.log\fR(5), \fBaudit_class\fR(5), \fBaudit_event\fR(5), \fBattributes\fR(7), \fBauditconfig\fR(8), \fBpraudit\fR(8)
.sp
.LP
\fIManaging Auditing in Oracle Solaris 11.4\fR
.SH DIAGNOSTICS
.sp
.LP
If unable to read either of its input files or to write its output file, \fBauditrecord\fR shows the name of the file on which it failed and exits with a non-zero return.
.sp
.LP
If no options are provided, if an invalid option is provided, or if both \fB-s\fR and \fB-p\fR are provided, an error message is displayed and \fBauditrecord\fR displays a usage message then exits with a non-zero return.
.SH NOTES
.sp
.LP
If \fB/etc/security/audit_event\fR has been modified to add user-defined audit events, \fBauditrecord\fR displays the record format as \fBundefined\fR.
.sp
.LP
The audit records displayed by \fBauditrecord\fR are the core of the record that can be produced. Various audit policies and optional tokens, such as those shown below, might also be present.
.sp
.LP
The following is a list of \fBpraudit\fR(8) token names with their descriptions.
.sp
.ne 2
.mk
.na
\fB\fBannotation\fR\fR
.ad
.br
.sp .6
.RS 4n
Present if audit record \fBannotation\fR is present.
.RE

.sp
.ne 2
.mk
.na
\fB\fBgroup\fR\fR
.ad
.br
.sp .6
.RS 4n
Present if the \fBgroup\fR audit policy is set.
.RE

.sp
.ne 2
.mk
.na
\fB\fBsensitivity label\fR\fR
.ad
.br
.sp .6
.RS 4n
Present when Trusted Extensions is enabled and represents the label of the subject or object with which it is associated. The \fBmandatory_label\fR token is noted in the basic audit record where a label is explicitly part of the record.
.RE

.sp
.ne 2
.mk
.na
\fB\fBsequence\fR\fR
.ad
.br
.sp .6
.RS 4n
Present when the \fBseq\fR audit policy is set.
.RE

.sp
.ne 2
.mk
.na
\fB\fBtrailer\fR\fR
.ad
.br
.sp .6
.RS 4n
Present when the \fBtrail\fR audit policy is set.
.RE

.sp
.ne 2
.mk
.na
\fB\fBzone\fR\fR
.ad
.br
.sp .6
.RS 4n
The name of the zone generating the record when the \fBzonename\fR audit policy is set. The \fBzonename\fR token is noted in the basic audit record where a zone name is explicitly part of the record.
.RE

.SH HISTORY
.sp
.LP
This functionality was originally provided in the \fBbsmrecord\fR command, which was added in Solaris 9. The command was renamed to \fBauditrecord\fR in Oracle Solaris 11.0.0.