Pull timestamp from audit event

[Kirkwood, David A.]

How can I pull the timestamp from a particular audit event. For example:
I want to pull all /bin/su events from the audit log for the week with
when they occurred. How can I do this?

 

Thanks

 

David A. Kirkwood



 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070322/9733361d/attachment.htm>