auditpr Command

Edit online

Purpose

Formats bin or stream audit records to a display device or printer.

Syntax

auditpr [-i inputfile ] [ -t 0 | 1 | 2 ] [ -m Message ] [ -r ] [ -v | -w] [ -X ][ -h field[,field]*]

Description

The auditpr command is part of the audit subsystem. This command reads audit records, in bin or stream format, from standard input and sends formatted records to standard output.

The output format is determined by the flags that are selected. If you specify the -m flag, a message is displayed before each heading. Use the -t and -h flags to change the default header titles and fields and the -v flag to append an audit trail. The auditpr command searches the local /etc/passwd file to convert user and group IDs to names.

An example of output using default header information follows:

event   login   status   time                             command
        wpar name
login   dick     OK       Fri  Feb;8   14:03:57    1990   login
        Global
 . . . . . trail portion . . . . .

For examples of audit trails, see the /etc/security/audit/events file where audit trail formats are defined.

Invalid records are skipped when possible, and an error message is issued. If the command cannot recover from an error, processing stops.

The AIX_AUDITBUFSZ environment variable allows buffered write operation of the auditpr audit records. The buffered write option is useful for high-performance applications that generate many audit records.

The AIX_AUDITBUFSZ environment variable accepts decimal and hexadecimal values in the range 8192 bytes - 67 MB. Any other positive values outside the range of allowed values are rounded off to either the beginning of the range or the end of the range based on the nearest value. If this variable value is not set or this variable is assigned negative values or non-numerical values, the AIX_AUDITBUFSZ variable is ignored.

Flags

Item Description
-h field[,field]* Selects the fields to display and the order in which to display them, by default e, l, R, t, and c. You can specify the following values:
e
The audit event.
l
The login name of the user.
R
The audit status.
t
The time the record was written.
c
The command name.
r
The real user name.
p
The process ID.
P
The ID of the parent process.
T
The kernel thread ID. This is local to the process; different processes may contain threads with the same thread ID.
h
The name of the host that generated the audit record. If there is no CPU ID in the audit record, the value none is used. If there is no matching entry for the CPU ID in the audit record, the 16 character value for the CPU ID is used instead.
i
The IDs or the names of roles of the audited process.
E
The effective privilege.
S
The effective sensitivity label (SL).
I
The effective integrity label (TL).
W
The workload partition name.
-i inputfile Indicates the path to the audit trail file. If the -i flag is not specified, the auditpr command reads data from stdin.
-m "Message" Specifies a Message to be displayed with each heading. You must enclose the Message string in double quotation marks.
-r Suppresses ID translation to the symbolic name.
-t {0 | 1 | 2} Specifies when header titles are displayed. The default title consists of an optional message (see the -m flag) followed by the name of each column of output.
0
Ignores any title.
1
Displays a title once at the beginning of a series of records.
2
Displays a title before each record.
-v Displays the trail of each audit record, using the format specifications in the /etc/security/audit/events file. The -v flag is mutually exclusive with the -w flag.
-w Displays the trail and audit record in a single line, by using the format specified in the /etc/security/audit/events file. The -w flag is mutually exclusive with -v flag.
-X Prints long user names at the end of the audit record when the -X flag is used with other flags that display the user names. The upper limit is determined by the max_logname Object Data Manager (ODM) attribute in the PdAt and CuAt object classes. If a user name is greater than the max_logname attribute, it is truncated to the number of characters minus 1 character, which is specified by the max_logname attribute.

Security

Access Control

This command should grant execute (x) access to the root user and members of the audit group. The command should be setuid to the root user and have the trusted computing base attribute.

Files Accessed

Mode File
r /etc/security/audit/events
r /etc/passwd
r /etc/group

Attention RBAC users and Trusted AIX® users: This command can perform privileged operations. Only privileged users can run privileged operations. For more information about authorizations and privileges, see Privileged Command Database in Security. For a list of privileges and the authorizations associated with this command, see the lssecattr command or the getcmdattr subcommand.

Examples

  1. To read the system audit trail file with default header titles and fields and an audit trail, enter:
    /usr/sbin/auditpr  -v < /audit/trail
    The /audit/trail file must contain valid audit bins or records.
  2. To format from an audit trail file all the audit events caused by user witte, enter:
    /usr/sbin/auditselect -e"login == witte"\
    /audit/trail | auditpr  -v
    The resulting record is formatted with the default values ( e, c, l, R, and t) and includes a trail.
  3. To read records interactively from the audit device, enter: 
    /usr/sbin/auditstream | /usr/sbin/auditpr -t0 -heRl
  4. To enable the buffered write option for the audit records with a buffer size of 520000 bytes for auditing subsystem that is started in bin mode, enter the following command:
    export AIX_AUDITBUFSZ=520000
/usr/sbin/auditpr -v -i /audit/trail > output

Files

Item Description
/usr/sbin/auditpr Specifies the path of the auditpr command.
/etc/security/audit/config Contains audit system configuration information.
/etc/security/audit/events Contains the audit events of the system.
/etc/security/audit/objects Contains audit events for audited objects (files).
/etc/security/audit/bincmds Contains auditbin backend commands.
/etc/security/audit/streamcmds Contains auditstream commands.
/etc/security/audit/hosts Contains the CPU ID to host name mappings.