aureport
Generate summary reports of auditd logs. tldr-pages
On Linux
Linux
Display a summary of auditd events
sudo aureportIdentifyGenerate a summary of login events
sudo aureport --loginIdentifyList all syscall reports
sudo aureport --syscallIdentifyGenerate a summary of executable events
sudo aureport --executableIdentifyShow a summary of events for a specific time range
sudo aureport --start start_time --end end_timeIdentifyList all audit files and the time range of events they cover
sudo aureport --log-timeIdentifyDisplay help
aureport --helpIdentify