NAME

audtrail  — A dcecp object that converts the audit trail into a readable format

SYNOPSIS

audtrail help  [operation | verbose  ]

audtrail operations

audtrail show audit_trail_file_name_list  [to filename]

Arguments

audit_trail_file_name_list
A list of one or more names of audit trail files.  The names are not the full pathnames, but only the residual file name.

operationThe name of the audtrail  operation for which to display help information. 

Description

The audtrail  object represents an audit trail file.  This command currently supports only one operation, which converts the audit trail into a human readable format. 

Errors

A representative list of errors that might be returned is not shown here.  Refer to the OSF DCE Problem Determination Guide for complete descriptions of all error messages. 

Operations

audtrail help

Returns help information about the audtrail  object and its operations.  The syntax is as follows:

audtrail help [operation | verbose ]

Options

verboseDisplays information about the audtrail  object. 

Used without an argument or option, the audtrail help  command returns brief information about each audtrail  operation.  The optional operation argument is the name of an operation about which you want detailed information.  Alternatively, you can use the verbose  option for more detailed information about the audtrail  object itself. 

Privileges Required

No special privileges are needed to use the audtrail help command. 

Examples

dcecp> audtrail help
show                Returns or files the contents of an audit trail file.
help                Prints a summary of command-line options.
operations          Returns a list of the valid operations for this command.
dcecp> 

audtrail operations

Returns a list of the operations supported by the audtrail object.  The syntax is as follows:

audtrail operations

The list of available operations is in alphabetical order except for help  and operations, which are listed last. 

Privileges Required

No special privileges are needed to use the audtrail operations command. 

Examples

dcecp> audtrail operations
show help operations
dcecp>

audtrail show

Returns the audit trail in a readable format.  The syntax is as follows:

audtrail show audit_trail_file_name_list [to  filename]

Options

to  filename
Specifies the name of the file in which to store the audit trail output.

The show  operation returns the audit trail in a readable format.  This command takes as an argument a list of names of audit trail files.  If more than one name is given, the output of each audit trail is concatenated and a blank line inserted between audit trails.  The to  option specifies a destination filename for the trail.  If this option is not present, the trail is returned from the command.  If the option is present, this operation returns an empty string. 

Because audit trail files can grow quite large, using the to  switch is strongly recommended to avoid reading the entire trail into memory. 

Note that when dcecp  processes output, it sends the entire set of returned information to an internal buffer before displaying it.  Therefore, when the output is directed to the screen, it can take a long time to appear. 

Privileges Required

You must have r (read) permission on the audit trail file on the local file system. 

Examples

dcecp> audtrail show my_trail
--- Start of an event record --- Event Number: 275
Event Name: LOGIN_getinfo
Event Outcome: success
Server: /.../stp.gburg.ibm.com/hosts/dceos2
Client: /.../stp.gburg.ibm.com/hosts/drinkernisti/self
Number of groups: 0
Authorization Status: Authorized with a pac
Date and Time recorded: 1994-12-19-19:02:27.037-05:00I-----
1 Event(s) specific:
   - item number 1             hosts/drinkernisti/self
--- End of an event record ---
 --- Start of an event record --- Event Number: 275
Event Name: LOGIN_getinfo
Event Outcome: success
Server: /.../stp.gburg.ibm.com/hosts/dceos2
Client: Unknown client and cell uuids
Number of groups: 0
Authorization Status: Authorized with a pac
Date and Time recorded: 1994-12-19-19:02:28.819-05:00I-----
1 Event(s) specific:
   - item number 1             dce-rgy
--- End of an event record ---
 dcecp>

Related Information

Commands: aud(8dce), audevents(8dce), auditd(8sec), audfilter(8dce), dcecp(8dce). 

Files: aud_audit_events(5sec), dts_audit_events(5sec), event_class(5sec), sec_audit_events(5sec).