Note: Audit Manager is deprecated and provided for backward compatibility only. We recommend that you use syslog events instead.
See
Enterprise Server Auditing for more information.
Restriction: This topic applies only when the Enterprise Server feature is enabled.
Syntax:
To access the active file's audit data, you must first make it available for dumping. Afterwards, it is no longer the active
file, and you can access the data it contains.
mfauditadm -p [-n instance-name | -f dump-audit-file]
Parameters:
- -p
- Make the active audit file available for dumping.
- -n
instance-name
- Specifies the name of the audit event consolidator instance, which is the name that applications use to communicate with
the audit event consolidator.
- -f
dump-audit-file
- The audit file to be made available for dumping.
Note: If neither
-n nor
-f are specified to identify the audit file, the command uses the current active file.
Example:
mfauditadm -p -f mfaudit.DOCTEST.aud_5