-
Reporting audit data by user:
auditrpt -u user,. . .
-
Reporting audit data by object:
auditrpt -f object_id,. . .
-
Reporting audit data by object type:
auditrpt -t object_type,. . .
-
Reporting audit data by event or event class:
auditrpt -e event,. . .
-
Reporting audit data by miscellaneous event subtype:
auditrpt -v subtype,. . .
-
Reporting audit data by outcome:
auditrpt -a [s | f]
-
Reporting audit data starting from time:
auditrpt -s time
-
Reporting all audit data involving use of any privileges:
auditrpt -p all
-
Reporting audit data involving use of specific privileges:
auditrpt -p priv,. . .
-
Reporting audit data prior to and including time:
auditrpt -h time
-
Including LWP ID information in an audit report:
auditrpt -x . . .
-
Reporting audit data "backwards," with most recent information displayed
first:
auditrpt -b
-
Reporting audit data as it is written to the log file:
auditlog -v 0
auditrpt -w
-
Reporting audit data based on the union (logical OR) of selection criteria:
auditrpt -o other options
-
Specifying a directory containing the audit map files:
auditrpt -m mapdir