audisp.1m (2010 09)

audisp(1M) audisp(1M)

-t start_time Display all audited operations occurring since start_time , speciﬁed as mmddhhmm[yy]

(month, day, hour, minute, year). If the year is speciﬁed and is greater than 70, it is

interpreted as in the twentieth century. Otherwise, it is interpreted as in the twenty-ﬁrst

century. If no year is given, the current year is used. No operation in the audit trail

occurring before the speciﬁed time is displayed.

-s stop_time Display all audited operations occurring before stop_time , speciﬁed as mmddhhmm[yy]

(month, day, hour, minute, year). If the year is speciﬁed and is greater than 70, it is

interpreted as in the twentieth century. Otherwise, it is interpreted as in the twenty-ﬁrst

century. If no year is given, the current year is used. No operation in the audit trail

occurring after the speciﬁed time is displayed.

-y2-y4 The year is displayed as a two digit number (with

-y2), or as a four digit number (with

-y4). The default is -y2

. Note that start_time and stop_time must still be speciﬁed as

two digit numbers.

AUTHOR

audisp was developed by HP.

FILES

/etc/audit/audit.conf

ﬁle containing event mapping information

/etc/audit/audit_site.conf

ﬁle containing site-speciﬁc event mapping information