Re: Dealing with BSM Audit Logs

On Oct 19, 2006, at 10:51 PM, Crist J. Clark wrote:

> Anyway, I am in search of tools to deal with audit logs. For
> example, I suspect that this noise is from ufsdump/restore,
> but this is hard to back out. It'd be sweet to have a tool
> where I could pull out all of the logs related to a process,
> including its children, and look at them. Something interactive
> would be so-o cool. Using auditreduce(1M) and praudit(1M) with
> grep, perl, and awk only goes so far, especially when it
> comes to GBs of logs.
>
> Are there tools out there for this? Any leads, from Sun, free
> stuff, your scripts, or third-party commercial, would help.

You could take a look at AuditViewer:

http://blogs.sun.com/martin/entry/audit_viewer_application

Early alpha, but at least something.

//Magnus