'\" te
.\" Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
.TH praudit 1M "24 Feb 2011" "SunOS 5.11" "System Administration Commands"
.SH NAME
praudit \- print contents of an audit trail file
.SH SYNOPSIS
.LP
.nf
\fBpraudit\fR [\fB-lrsx\fR] [\fB-d\fR\fIdel\fR] [\fIfilename\fR]...
.fi

.SH DESCRIPTION
.sp
.LP
\fBpraudit\fR reads the listed \fIfilename\fRs (or standard input, if no \fIfilename\fR is specified) and interprets the data as audit trail records as defined in \fBaudit.log\fR(4). By default, times, user and group \fBIDs\fR (UIDs and \fBGIDs,\fR respectively) are converted to their \fBASCII\fR representation. Record type and event fields are converted to their \fBASCII\fR representation. A maximum of 100 audit files can be specified on the command line.
.SH OPTIONS
.sp
.LP
The following options are supported: 
.sp
.ne 2
.mk
.na
\fB\fB-d\fR\fIdel\fR\fR
.ad
.sp .6
.RS 4n
Use \fIdel\fR as the field delimiter instead of the default delimiter, which is the comma. If \fIdel\fR has special meaning for the shell, it must be quoted. The maximum size of a delimiter is three characters. The delimiter is not meaningful and is not used when the \fB-x\fR option is specified.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-l\fR\fR
.ad
.sp .6
.RS 4n
Print one line per record.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-r\fR\fR
.ad
.sp .6
.RS 4n
Print records in their raw form. Times, \fBUIDs,\fR \fBGIDs,\fR record types, and events are displayed as integers. This option is useful when naming services are offline. The \fB-r\fR option and the \fB-s\fR option are exclusive. If both are used, a format usage error message is output.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-s\fR\fR
.ad
.sp .6
.RS 4n
Display records in their short form. Numeric fields' ASCII equivalents are looked up by means of the sources specified in the \fB/etc/nsswitch.conf\fR file (see \fBnsswitch.conf\fR(4)). All numeric fields are converted to ASCII and then displayed. The short \fBASCII\fR representations for the record type and event fields are used. This option and the \fB-r\fR option are exclusive. If both are used, a format usage error message is output.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-x\fR\fR
.ad
.sp .6
.RS 4n
Print records in XML form. Tags are included in the output to identify tokens and fields within tokens. Output begins with a valid XML prolog, which includes identification of the DTD which can be used to parse the XML.
.RE

.SH FILES
.sp
.ne 2
.mk
.na
\fB\fB/etc/security/audit_event\fR\fR
.ad
.sp .6
.RS 4n
Audit event definition and class mappings.
.RE

.sp
.ne 2
.mk
.na
\fB\fB/etc/security/audit_class\fR\fR
.ad
.sp .6
.RS 4n
Audit class definitions.
.RE

.sp
.ne 2
.mk
.na
\fB\fB/usr/share/lib/xml/dtd\fR\fR
.ad
.sp .6
.RS 4n
Directory containing the verisioned DTD file referenced in XML output, for example, \fBadt_record.dtd.1\fR.
.RE

.sp
.ne 2
.mk
.na
\fB\fB/usr/share/lib/xml/style\fR\fR
.ad
.sp .6
.RS 4n
Directory containing the versioned XSL file referenced in XML output, for example, \fBadt_record.xsl.1\fR.
.RE

.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
tab() box;
cw(2.75i) |cw(2.75i) 
lw(2.75i) |lw(2.75i) 
.
ATTRIBUTE TYPEATTRIBUTE VALUE
_
Availabilitysystem/core-os
_
Interface StabilitySee below.
.TE

.sp
.LP
The command stability is evolving. The output format is unstable.
.SH SEE ALSO
.sp
.LP
\fBgetent\fR(1M), \fBgetpwuid\fR(3C), \fBgethostbyaddr\fR(3NSL), \fBethers\fR(3SOCKET), \fBgetipnodebyaddr\fR(3SOCKET), \fBaudit.log\fR(4), \fBaudit_class\fR(4), \fBaudit_event\fR(4), \fBgroup\fR(4), \fBnsswitch.conf\fR(4), \fBpasswd\fR(4), \fBattributes\fR(5)
.sp
.LP
See the section on Auditing in \fISecuring Systems and Attached Devices in Oracle Solaris 11.3\fR.