Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual page 415

Create a Report from All System Call Events
To analyze the audit log from a system call's point of view, use the aureport
-s command. This command generates a numbered list of all system call events
including date, time, number of the system call, process ID, name of the command
that used this call, audit ID, and event number.
aureport -s
Syscall Report
=======================================
# date time syscall pid comm auid event
=======================================
1. 16/02/09 17:45:01 2 20343 cron -1 2279
2. 16/02/09 17:45:02 83 20350 mktemp 0 2284
3. 16/02/09 17:45:02 83 20351 mkdir 0 2285
Create a Report from All Executable Events
To analyze the audit log from an executable's point of view, use the aureport
-x command. This command generates a numbered list of all executable events
including date, time, name of the executable, the terminal it is run in, the host exe-
cuting it, the audit ID, and event number.
aureport -x
Executable Report
====================================
# date time exe term host auid event
====================================
1. 13/02/09 15:08:26 /usr/sbin/sshd sshd 192.168.2.100 -1 12
2. 13/02/09 15:08:28 /usr/lib/gdm/gdm-session-worker :0 ? -1 13
3. 13/02/09 15:08:28 /usr/sbin/sshd ssh 192.168.2.100 -1 14
Create a Report about Files
To generate a report from the audit log that focuses on file access, use the
aureport -f command. This command generates a numbered list of all file-
related events including date, time, name of the accessed file, number of the system
call accessing it, success or failure of the command, the executable accessing the
file, audit ID, and event number.
aureport -f
File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 16/02/09 17:45:01 /etc/shadow 2 yes /usr/sbin/cron -1 2279
2. 16/02/09 17:45:02 /tmp/ 83 yes /bin/mktemp 0 2284
3. 16/02/09 17:45:02 /var 83 no /bin/mkdir 0 2285
Understanding Linux Audit 401