Solaris

# grep useradd /var/log/*
grep: /var/log/anaconda: Is a directory
grep: /var/log/audit: Is a directory
grep: /var/log/chrony: Is a directory
grep: /var/log/httpd: Is a directory
grep: /var/log/mariadb: Is a directory
grep: /var/log/qemu-ga: Is a directory
grep: /var/log/rhsm: Is a directory
grep: /var/log/sa: Is a directory
/var/log/secure-20180522:May 15 17:33:41 centos7host useradd[1054]: new user: name=apache, UID=48, GID=48, home=/usr/share/httpd, shell=/sbin/nologin
/var/log/secure-20180522:May 15 17:50:10 centos7host useradd[1387]: new user: name=mysql, UID=27, GID=27, home=/var/lib/mysql, shell=/sbin/nologin
/var/log/secure-20180522:May 15 18:16:19 centos7host useradd[5588]: new group: name=nagios, GID=1002
/var/log/secure-20180522:May 15 18:16:19 centos7host useradd[5588]: new user: name=nagios, UID=1001, GID=1002, home=/home/nagios, shell=/bin/bash

#!/bin/ksh

# Record the activity
logger "$(who am i) running $0 $@"
echo   "$(who am i) running $0 $@" >> /var/log/myauditlog

# Call the real command
/usr/bin/secure/${0##*/} $@