Red Hat Enterprise Linux 5 Administration Unleashed

Analyzing the Records 517you must be the root user to execute the aureport command. If aureport is executedwithout any options, a summary report as shown in Listing 25.7 is displayed.LISTING 25.7aureport SummarySummary Report======================Range of time: 11/29/2006 03:40:18.155 - 01/07/2007 23:29:02.898Number of changes in configuration: 71Number of changes to accounts, groups, or roles: 14Number of logins: 38Number of failed logins: 0Number of users: 3Number of terminals: 35Number of host names: 7Number of executables: 55Number of files: 1186Number of AVC denials: 0Number of MAC events: 70Number of failed syscalls: 2594Number of anomaly events: 46Number of responses to anomaly events: 0Number of crypto events: 0Number of process IDs: 3734Number of events: 3374325To generate a more specific report, execute the aureport command as root followed byone or more options from Table 25.2. These options narrow down the report to specificdata such as system calls or configuration changes.TABLE 25.2 aureport Options for Generating Specific ReportsOption Description-a Report messages about access vector cache (AVC)-c Report messages about configuration changes-crReport messages about crypto events-e Report messages about events-f Report messages about files-h Report messages about hosts-l Report messages about logins-m Report messages about account modifications-maReport messages about Mandatory Access Control (MAC) events-p Report messages about processes-s Report messages about system calls-tmReport messages about terminals