PRAUDIT(1)

🎀 PRAUDIT 💅

ok so bestie, welcome to praudit(1) — that's the section 1 manual page for praudit, literally the tool that reads your audit trail files out loud (well, prints them) so you can actually look at them 👑

---

✨ SYNOPSIS ✨

praudit [-lpx] [-r | -s] [-d del] [file ...]

like yes that's the whole vibe. flags go in, files go in, readable audit tokens come out 🦋

---

🌸 DESCRIPTION 🌸

okay so the tea: praudit prints the contents of audit trail files to standard output in human-readable form 💖 and if you don't give it any file argument at all? it just reads from standard input by default. no cap, it's that easy.

The options are as follows, bestie — pay attention, this is the good part 👇

• -d del — Specifies the delimiter. and the default delimiter? the comma. iconic of it honestly 🍓
• -l — Prints the entire record on the same line. if you don't pass this, every token gets displayed on a different line. so yeah, -l is the "squish it all together" flag ✨
• -p — Specify this one if input to praudit is piped from the tail(1) utility. this makes praudit sync to the start of the next record 🫶
• -r — Prints the records in their raw, numeric form. heads up: this option is exclusive from -s — it's giving "pick one, you can't have both" 💀
• -s — Prints the tokens in their short form. short text representations for record and event type are displayed. and this one is exclusive from -r — same deal, it's a whole either/or situation 🙈
• -x — Print audit records in the XML output format. yes, XML. somebody had to do it 🧚

so if you don't specify raw or short form, the default is printing tokens in their long form 💜 and in long form it gets gorgeous:

• Events are displayed as per their descriptions given in /etc/security/audit_event
• UIDs and GIDs are expanded to their names
• dates and times are displayed in human-readable format 🌈

---

💖 FILES 💖

• /etc/security/audit_class — Descriptions of audit event classes.
• /etc/security/audit_event — Descriptions of audit events.

---

🦋 SEE ALSO 🦋

auditreduce(1), audit(4), auditpipe(4), audit_class(5), audit_event(5)

---

👑 HISTORY 👑

so the lore is: the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in 2004 ⭐ and then it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. main character origin story fr fr 😭

---

🌸 AUTHORS 🌸

This software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. Additional authors include Wayne Salamon, Robert Watson, and SPARTA Inc. 💅

and also — the Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. absolute legends, we stan 🌟

---

ngl the vibes are immaculate but like... -r and -s are mutually exclusive, remember that or it's gonna be a whole thing 💀

---

okay that's the page, bestie — love u, go read those audit trails 💜 this was the Debian build of the page, dated November 5, 2006, and yes, PRAUDIT(1) ate and left no crumbs. periodt 🎀✨