How do I view logs and audit users ? (4295637)

Commands can be replayed by an administrator using the “pmreplay” utility. The input and output of commands executed with Privilege Manager are stored within the “iologs” directory and are organised by profile, user and command by default.

# pmreplay <I/O Log Filename>

The details of each command executed with Privilege are added to the event log which can be viewed using the “pmlog” utility.

Example:

To view all the commands executed by a particular user on a set day you would type:

# pmlog -c ' user==“earl" && date=="2009/08/19" ‘
Accept 2009/08/19 14:43:39 earl@sol10master.democorp.local -> root@sol10master
       service
       Command finished with exit status 0
Reject 2009/08/19 16:11:54 earl@sol10master.democorp.local
       shutdown

To find out what the I/O log Filename to replay you can do the "pmlogsearch" command on the policy server as root.  

Example: