Note: Audit Manager is deprecated and provided for backward compatibility only. We recommend that you use syslog events instead. See
Enterprise Server Auditing for more information.
Syntax:
To access the active file's audit data, you must first make it available for dumping. Afterwards, it is no longer the active file, and you can access the data it contains.
mfauditadm -p [-n instance-name | -f dump-audit-file]
Parameters:
- -p
- Make the active audit file available for dumping.
- -n
instance-name
- Specifies the name of the audit event consolidator instance, which is the name that applications use to communicate with the audit event consolidator.
- -f
dump-audit-file
- The audit file to be made available for dumping.
Note: If neither
-n nor
-f are specified to identify the audit file, the command uses the current active file.
Example:
mfauditadm -p -f mfaudit.DOCTEST.aud_5
