ADVERTISEMENT

symaudit commands

The symaudit commands can be used to extract the records from the Symmetric Audit Log file. We can find out which users or applications started a particular action at a specified time frame, that caused a specific behaviour in the array.

Below list contains some of the most useful symaudit command examples.

• symaudit -sid 1234 list -application_id SYMRDF

  List all the symrdf operation records from the Symaudit log file.
  Copied

• symaudit -sid 1234 list -application_id SYMRDF -action_code -exclude Split

  List all the symrdf operation records excluding the Split actions from the Symaudit log file.
  Copied

• symaudit -sid 1234 list -application_id SYMRDF -action_code Split

  List all the symrdf split operation records from the Symaudit log file.
  Copied

• symaudit -sid 1234 list -end_date 10/02/17:12:30

  List all the Symaudit records logged till 2nd Oct 2017 12:30 starting from the first record.
  Copied

• symaudit -sid 1234 list -funtion_class DevMask

  List all the records related to Device Masking from the Symaudit log file.
  Copied

• symaudit -sid 1234 list -last_n 10

  List the last or latest 10 records from the Symaudit log file.
  Copied

• symaudit -sid 1234 list -n 10

  List the first or oldest 10 records from the Symaudit log file.
  Copied

• symaudit -sid 1234 list -record_num 100 -n 1

  List the 100th record from the Symaudit log file
  Copied

• symaudit -sid 1234 list -record_num 100 -n 1 -text

  List the 100th record from the Symaudit log file along with its text description.
  Copied

• symaudit -sid 1234 list -record_num 100 -n 1 -v

  Shows the detailed information about the 100th record in the Symaudit log file. This includes the additional information such as the username who initiated the action and the hostname from where it is executed.
  Copied

• symaudit -sid 1234 list -record_num 100 -n 10

  List the 100th to 110th records from the Symaudit log file
  Copied

• symaudit -sid 1234 list -start_date 10/01/17:12:30

  List all the Symaudit records logged from 1st Oct 2017 12:30 to till date
  Copied

• symaudit -sid 1234 list -start_date 10/01/17:12:30 -end_date 10/02/17:12:30

  List all the Symaudit records logged from 1st Oct 2017 12:30 to 2nd Oct 2017 12:30
  Copied

• symaudit -sid 1234 list -symdev_range AAAAA:BBBBB

  Filter those records with text description includes the devices AAAAA or BBBBB
  Copied

• symaudit -sid 1234 list -symdev_range AAAAA:BBBBB -v

  Shows the detailed information of the records in the Symaudit log file, those text description includes the devices AAAAA or BBBBB.
  Copied

• symaudit -sid 1234 list -user test_user

  List all the records for those activities performed by test_user
  Copied

• symaudit -sid 1234 monitor -i 5 -c 10

  Monitor the Symaudit log for any new entries, every 5 seconds and display the result if any thing added. This activity will repeat for 10 times.
  Copied

• symaudit -sid 1234 show

  Shows the total number of records in the Symaudit log file, along with the starting and ending record number. This command also shows the time frame from when the audit log started and at which time the last entry added.
  Copied