9.4. Analyzing the Audit Trail

The audit trail is stored in a binary format. This format saves space, but cannot be read without an application that understands the file format. To analyze the audit trail, you use the praudit command. By default, this command converts the audit records to a plain text format, but the command can also generate XML format. XML output is useful input to other programs.

Because the audit records are ordered in the audit trail by time of creation, the actions of multiple users are mingled. To follow the actions of a single user, you must filter the audit trail. The auditreduce command is a filtering command. This command enables you to select specific records from the audit trail based on a number of criteria, such as audit ID, user ID, session ID, audit event, and audit class.