How to read audit logs

[hpuxrox]

I am looking for a way to read tbc audit logs from windows. Is anyone aware of a tool to do this.

[Paula J Frazer-Campbell]

Hi

If they are not binary then wordpad or notepad may do it.

If they are tab or comma seperated then import them into Excel.

Paula

[harry d brown jr]

I believe you mean TCB and not TBC audit logs, correct?


live free or die
harry

[hpuxrox]

Paula, They are in binary format.

Harry, Yes, I typoed, I mean TCB.


Thanks

[Paula J Frazer-Campbell]

Hi

If in binary try on the unix end:-

strings

Is the output any use?

Paula

[Sridhar Bhaskarla · Accepted solution]

Yates,

I assume you are talking about current and next audit files (by default audfile1, audfile2). You will need to use 'audisp' command to convert them into text files.

audisp > audfile.txt

You can use switches to audisp command to filter out the users, events, calls etc.,

I don't think you can view them on windoz. You can convert them to text on HP box and then open them in windoz using word etc.,

-Sri

[hpuxrox]

Thanks again man! I think audisp will work, I would just need to setup a script to do this automatily on demand for security. Problem is, 1G of audit logs a day converted to asci will take a LOT of space.

[Darren Prior]

Hi Yates,

The file format for these files is defined in the audit(4) man page. It might be worth writing something in C or Perl that could read that format, in other words write your own audisp that would run on the PC.

regards,

Darren.