admhist(8) 맨 페이지 - 윈디하나의 솔라나라

개요

섹션
맨 페이지 이름
검색(S)

admhist(8)

admhist(8)              System Administration Commands              admhist(8)

NAME
       admhist - display a summary of administrative events on the system.

SYNOPSIS
       admhist [-a date-time] [-b date-time] [-d date-time] [-z zonename]
            [-u username] [-v] [-R pathname] [audit-trail-file]...


       admhist [-a date-time] [-b date-time] [-d date-time] [-z zonename]
            [-u username] [-v] -R pathname

DESCRIPTION
       The  admhist command displays a summary of the successful system admin‐
       istration related events in ASCII format. The admhist command also dis‐
       plays a summary of Service Management Facility (SMF) audit  events.  By
       default,  the  events  are  selected  from  the audit trail files under
       /var/audit. However, an alternate audit directory can be  specified  by
       using  the -R option, or specific audit trail files can be specified on
       the command line. Only users with the PRIV_FILE_DAC_READ privilege  can
       use the admhist utility. If Trusted Extensions have been enabled, users
       must also have the PRIV_SYS_TRANS_LABEL privilege. Both of these privi‐
       leges are included in the Audit Review rights profile.

OPTIONS
       The following options are supported:

       -a date-time       Selects  administrative and SMF events that occurred
                          on or after the date-time. The date-time argument is
                          described under the 'Time  Formats'  section  below.
                          The -a and -b options can be used together to form a
                          range.


       -b date-time       Selects  administrative and SMF events that occurred
                          before the date-time. The date-time argument is  de‐
                          scribed under the 'Time Formats' section below.


       -d date-time       Selects  administrative and SMF events that occurred
                          on a specific day. The  date-time  argument  is  de‐
                          scribed under the 'Time Formats' section below.


       -z zonename        Selects administrative and SMF events from the spec‐
                          ified  zone name. This option only applies to admin‐
                          istrative events generated when the  zonename  audit
                          policy has been enabled. For more information, refer
                          to the auditconfig(8) man page.


       -u username/uid    Select events for the specified (audit) userid/user‐
                          name.  Can  be  specified  multiple  times to select
                          events from multiple users.


       -v                 Verbose. Includes the hostname and  current  working
                          directory associated with each administrative event.


       -R                 Specifies  the  pathname  of  an alternate directory
                          containing audit trail files.


   Time Formats
       The date-time argument to -a, -b, and -d options can be any one of  the
       following forms:

           o      An absolute date-time which has the following form:


                    yyyymmdd [ hh [ mm [ ss ]]]

                  where  yyyy  specifies  a  year  (with  1970 as the earliest
                  value), mm is the month (value between 01 through 12), dd is
                  the day (value between 01 through 31), hh is the hour (value
                  between 00 through 23), mm is the minute (value  between  00
                  through  59), and ss is the second (value between 00 through
                  59). The default value is 00 for hh, mm, and ss.


           o      Plain language descriptions of dates which have the  follow‐
                  ing form:


                    today, yesterday
                    last week, last month, last year
                    last N hours, last N days, last N weeks, last N months,
                    last N years

                  where N is the number of units.

                  When  entering  commands  at  a  shell  prompt or in a shell
                  script, dates specified as  multiple  words  will  generally
                  need  to be quoted in order for them to be treated as a sin‐
                  gle argument, as shown in the Examples below.


FILES
       /var/audit/*    The default location of audit trail files, when  stored
                       locally by using audit_binfile(7).


EXAMPLES
       Example 1 Displaying System Administration Events in a Zone



       The following command displays the system administration events and SMF
       events that occurred in zone myzone.


         # admhist -z myzone


       Example 2 Displaying System Administration Events on the System



       The following command displays the system administration events and SMF
       events that occurred on the system in the last eight hours.


         # admhist -a "last 8 hours"


       Example 3 Displaying System Administration Events from Past Week



       The following command displays the system administration events and SMF
       events that occurred in the past week excluding yesterday.


         # admhist -a "last week" -b yesterday


       Example 4 Displaying Events in a Specific Audit Trail File



       The following command displays the system administration events and SMF
       events present in a specific audit trail file.


         # admhist /var/audit/20150507091957.20150521095216.hostname


       Example 5 Displaying audit events on the System



       The following command displays the system administration events and the
       SMF  events  that  occurred on the system during the specified time pe‐
       riod.


         # admhist -a "last 3 hours"
         2023-01-24 10:49:04 jack /usr/bin/su su - jack
         2023-01-24 10:49:05 jack /usr/bin/su su -
         2023-01-24 10:49:14 jack success change service instance property svc:/system/system-log:rsyslog/:properties/restarter_actions/auxiliary_tty
         2023-01-24 10:49:14 jack success change service instance property svc:/system/system-log:rsyslog/:properties/restarter_actions/auxiliary_fmri
         2023-01-24 10:49:14 jack success persistently enable service instance svc:/system/system-log:rsyslog/:properties/general/enabled
         2023-01-24 10:49:14 jack success change service instance property svc:/system/system-log:rsyslog/:properties/general/enabled
         2023-01-24 10:49:24 jack success change service instance property svc:/system/system-log:default/:properties/restarter_actions/auxiliary_tty
         2023-01-24 10:49:24 jack success change service instance property svc:/system/system-log:default/:properties/restarter_actions/auxiliary_fmri
         2023-01-24 10:49:24 jack success persistently disable service instance svc:/system/system-log:default/:properties/general/enabled
         2023-01-24 10:49:24 jack success change service instance property svc:/system/system-log:default/:properties/general/enabled


ATTRIBUTES
       See attributes(7) for descriptions of the following attributes:

       tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE  TYPEAT‐
       TRIBUTE VALUE _ Availabilitysystem/core-os _ Interface StabilitySee be‐
       low



       The interface stability of the admhist command is Committed. The inter‐
       face stability of the output of admhist is Not-an-Interface.

SEE ALSO
       audit.log(5),  audit_tags(5),  attributes(7),  privileges(7), auditcon‐
       fig(8), auditreduce(8)


       Managing Auditing in Oracle Solaris 11.4

HISTORY
       The -u option was added in Oracle Solaris 11.4.36.


       The admhist command was added in Oracle Solaris 11.4.0.

Oracle Solaris 11.4               13 Sep 2024                       admhist(8)
맨 페이지 내용의 저작권은 맨 페이지 작성자에게 있습니다.
RSS ATOM XHTML 5 CSS3