bsmrecord(1M)						  System Administration Commands					     bsmrecord(1M)

NAME

       bsmrecord - display Solaris audit record formats

SYNOPSIS

       /usr/sbin/bsmrecord [-d] [ [-a] | [-e string] | [-c class] | [-i id] | [-p programname] | [-s systemcall] | [-h]]

DESCRIPTION

       The  bsmrecord  utility	displays  the  event ID, audit class and selection mask, and record format for audit record event types defined in
       audit_event(4).	You can use bsmrecord to generate a list of all audit record formats, or to select audit record  formats  based  on  event
       class, event name, generating program name, system call name, or event ID.

       There  are  two	output	formats. The default format is intended for display in a terminal window; the optional HTML format is intended for
       viewing with a web browser.

OPTIONS

       The following options are supported:

       -a		       List all audit records.

       -c class 	       List all audit records selected by class. class is one of the two-character class codes from  the  file	/etc/secu-
			       rity/audit_class.

       -d		       Debug  mode.  Display  number  of  audit  records that are defined in audit_event, the number of classes defined in
			       audit_class, any mismatches between the two files, and report which defined events do not have  format  information
			       available to bsmrecord.

       -e string	       List all audit records for which the event ID label contains the string string. The match is case insensitive.

       -h		       Generate the output in HTML format.

       -i id		       List the audit records having the numeric event ID id.

       -p programname	       List  all  audit records generated by the program programname, for example, audit records generated by a user-space
			       program.

       -s systemcall	       List all audit records generated by the system call systemcall, for example, audit records generated  by  a  system
			       call.

       The -p and -s options are different names for the same thing and are mutually exclusive. The -a option is ignored if any of -c, -e, -i, -p,
       or -s are given.  Combinations of -c, -e, -i, and either -p or -s are ANDed together.

EXAMPLES

       Example 1: Displaying an Audit Record with a Specified Event ID

       The following example shows how to display the contents of a specified audit record.

       % bsmrecord -i 6152
       login: terminal login
	 program     /usr/sbin/login	  see login(1)
	 event ID    6152		  AUE_login
	 class	     lo(0x00001000)
	     header-token
	     subject-token
	     text-token 		  error message
	     exit-token

       Example 2: Displaying an Audit Record with an Event ID Label that Contains a Specified String

       The following example shows how to display the contents of a audit record with an event ID label that contains the string login.

       # bsmrecord -e login
       terminal login
	 program     /usr/sbin/login	  see login(1)
	 event ID    6152		  AUE_login
	 class	     lo(0x00001000)
	     header-token
	     subject-token
	     text-token 		  error message
	     exit-token

       rlogin
	 program     /usr/sbin/login	  see login(1) - rlogin
	 event ID    6155		  AUE_rlogin
	 class	     lo(0x00001000)
	    header-token
	    subject-token
	    text-token			 error message
	    exit-token

EXIT STATUS

       0	Successful operation

       non-zero Error

FILES

       /etc/security/audit_class

	   Provides the list of valid classes and the associated audit mask.

       /etc/security/audit_event

	   Provides the numeric event ID, the literal event name, and the name of the associated system call or program.

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWcsr			   |
       +-----------------------------+-----------------------------+
       |CSI			     |Enabled			   |
       +-----------------------------+-----------------------------+
       |Interface Stability	     |Unstable			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       audit_class(4), audit_event(4), attributes(5)

DIAGNOSTICS

       If unable to read either of its input files or to write its output file, bsmrecord shows the name of the file on which it failed and  exits
       with a non-zero return.

       If  no  options	are  provided, if an invalid option is provided, or if both -s and -p are provided, an error message is displayed and bsm-
       record displays a usage message then exits with a non-zero return.

NOTES

       If /etc/security/audit_event has been modified to add user-defined audit events, bsmrecord displays the record format as undefined.

SunOS 5.10							    14 Jan 2003 						     bsmrecord(1M)