Analyze/audit to get new & removed users and password changes

[Richard kelly_2]

I'm tyring to use the analyze/audit command to generate a summary of
- Created accounts
- Deleted accounts
- Password changes

I can use the following command to get password changes:
anal/audit/event=auth/select=sensitive_field_name=password

But how do I select the specific records to indicate which records are added and deleted

I tried the suggestions in
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=833530

But it does noto generate what I'm looking for.

[Karl Rohwedder · Accepted solution]

Pls try

$ ANA/AUDIT/EVENT=SYSUAF/SELEC=SUBTYPE=SYSUAF_ADD

or ...SUBTYPE=SYSUAF_DELETE

regards Kalle

[Richard kelly_2]

Thanks very much. It works perfectly