|
|
The following options are available:
The values for type may be N, for native machine format, or X, for XDR format. If an invalid conversion type or combination of conversion types is requested an error message is displayed (see ``Diagnostics''). If no options are specified it is assumed the input file is in native machine format and the output file is in XDR format. If the format of the input file does not match the type specified by the -i option or the assumed format an error message is displayed (see ``Diagnostics'').
The procedure for transferring an audit log file from one machine to another has basically three steps. First, the audit log is converted from native machine format to the portable XDR format, using a command like the following:
cat /var/audit/1125103 | auditfltr -iN -oX > /var/tmp/1125103.xfer
Second, the file is transferred to another machine.
This can be done by transferring the file to magnetic media on one with
cpio or tcpio
and then restoring it on the other.
Third, the file is converted back to machine format. If we assume,
to avoid confusion with the destination machine's own audit log
files, that we have created a subdirectory import under
/var/audit, we might convert the file with a command like
the following:
cat /var/tmp/1125103.xfer | auditfltr -iX -oN > /var/audit/import/1125103
Audit log files are identified by their version number.
Conversion of log files of a particular version generally requires the presence of a specific auditfltr executable for that version.
The version number is automatically identified by auditfltr, and the proper version-specific auditfltr is automatically called.
If the required version-specific auditfltr is not present or is not executable, an error
message is displayed
(see ``Diagnostics'').
See
auditrpt(1M)
for more about version numbers.
usage: auditfltr [[-iN] [-oX]] | [-iX -oN]
Invalid command syntax.
conversion type
type is not supported
usage: auditfltr [[-iN] [-oX]] | [-iX -oN]
The valid conversion types are X, for External Data Representation or N, for native machine format.
invalid combination of conversion types
usage: auditfltr [[-iN] [-oX]] | [-iX -oN]
error manipulating file
File manipulation error occurred during a write or read operation.
could not obtain version number
Reading the version number from the input file failed.
unknown audit version number
The version number of the input log file is invalid. Valid version numbers are: 1.0, 2.0, 3.0, 4.0.
bad log record type
Invalid record type encountered in the audit log file.
unable to allocate space
input file is in invalid format
The format of the audit log used as input does not match the format specified by the -i option of the command.
Version specific auditfltr not found:
version
Version specific auditfltr not executable:
version
XDR encryption of an audit record field failed
XDR decryption of an audit record field failed