HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

9.9.1 Examples of Using the audisp Command
The following examples show audit information displayed using the audisp command:
• Display the log output on the screen:
#/usr/sbin/audisp audit_trail
• Direct the log output to /tmp/mylogoutput:
#/usr/sbin/audisp audit_trail > /tmp/mylogoutput
• View successful events only:
#/usr/sbin/audisp -p audit_trail
• View activities owned by user joe:
#/usr/sbin/audisp -u joe audit_trail
• View activities on terminal, ttypa:
#/usr/sbin/audisp -l ttypa audit_trail
• View login events only:
#/usr/sbin/audisp -e login audit_trail
9.10 Self-Auditing
Some processes invoke a series of actions that can be audited. To reduce the amount
of audit log data collected and to provide for more meaningful notations in the audit
log files, some of these processes are programmed to suspend auditing of the actions
they invoke and produce one audit log entry describing the process that occurred.
Processes programmed in this way are called self-auditing programs; using self-auditing
programs streamlines audit log data.
NOTE: The list of self-auditing processes varies from system to system.
Self-auditing processes
The following processes have self-auditing capabilities:
chfn Change finger entry
chsh
Change login shell
login
The login utility
newgrp
Change effective group
passwd
Change password
audevent
Select events to be audited
audisp
Display the audit data
audsys
Start or halt the auditing system
audusr
Select users to be audited
9.10 Self-Auditing 181