Displaying audit trail information

Displaying information by object identity

The -f option of the auditrpt command is used to display audit information for specific objects. The argument to -f may consist of one or more of the following objects

regular file
special character file
special block file
named pipe
IPC id
loadable module id
directory

Each object must be separated by a comma. A space will be interpreted as the end of the object list. An object (except for an IPC id or loadable module id) must be specified by its full pathname. For example, to display audit information related to the object /etc/passwd, enter the following command:

auditrpt -f /etc/passwd

For example, assume that your system has two files, /proj/mgmt/schedule and /proj/mgmt/staff, that contain sensitive information about a new product that your company is developing. The following command displays all the audit information related to each file:

auditrpt -f /proj/mgmt/schedule,/proj/mgmt/staff

If the object specified is not a full pathname, the following error message is displayed and processing is terminated:

full pathname must be specified for object_id