show audit-search

This command searches the audit log and displays matching events.

Syntax

show audit-search [-np] user name

show audit-search [-np] date start [end]

show audit-search [-np] time start [end]

show audit-search [-np] address address[/netmask]

Parameters

-np: Indicates no pagination.
user name: Displays events in the audit log for the specified user.
date start [end]: Displays events in the audit log from the specified start date to optional end date. Without an end date, displays events to the most recent date.
time start [end]: Displays events in the audit log from the specified start time to the optional end time. Without an end time, displays events until 23:59:59.
address address[/netmask]: Displays events in the audit log for the specified IP address or, if you use a netmask, the IP address range.

Guidelines

The show audit-search command searches the audit log and displays events that match the specified criteria. Use the -np parameter to indicate no pagination for the output.

Examples

Display events in the audit log for the joesmith account one screen at a time.
```
# show audit-search user joesmith
#
```
Display events in the audit log from February 10, 2008 onward one screen at a time.
```
# show audit-search date 20080210
#
```
Display events in the audit log from IP address 10.10.10.15 upward as one continuous list.
```
# show audit-search -np address 10.10.10.15
#
```
Display events in the audit log from the IP address in the range of 10.10.10.0 through 10.10.10.255 one screen at a time.
```
# show audit-search address 10.10.10.0/24
#
```