1AUVIRT(8)               System Administration Utilities              AUVIRT(8)
2
3
4

NAME

6       auvirt - a program that shows data related to virtual machines
7
8

SYNOPSIS

10       auvirt [ OPTIONS ]
11
12

DESCRIPTION

14       auvirt  shows  a  list  of guest sessions found in the audit logs. If a
15       guest is specified, only the events related to that  guest  is  consid‐
16       ered. To specify a guest, both UUID or VM name can be given.
17
18       For  each  guest session the tool prints a record with the domain name,
19       the user that started the guest, the time when the  guest  was  started
20       and the time when the guest was stopped.
21
22       If  the option "--all-events" is given a more detailed output is shown.
23       In this mode other  records  are  shown  for  guest's  stops,  resource
24       assignments,  AVC  and  anomaly  events.  The first field indicates the
25       event type and can have the following values: start,  stop,  res,  avc,
26       and anom.
27
28       Resource  assignments have the additional fields: resource type, reason
29       and resource. And AVC records have  the  following  additional  fields:
30       operation, result, command and target.
31
32       By  default,  auvirt  reads records from the system audit log file. But
33       --stdin and --file options can be specified to change this behavior.
34
35

OPTIONS

37       --all-events
38              Show records for all virtualization related events.
39
40       --debug
41              Print debug messages to standard output.
42
43       -f, --file file
44              Read records from the given file instead from the  system  audit
45              log file.
46
47       -h, --help
48              Print help message and exit.
49
50       --proof
51              Add  after  each  event a line containing all the identifiers of
52              the audit records used to calculate the event.  Each  identifier
53              consists of unix time, milliseconds and serial number.
54
55       --show-uuid
56              Add the guest's UUID to each record.
57
58       --stdin
59              Read  records  from  the  standard input instead from the system
60              audit log file.  This option cannot be  specified  with  --file.
61              The audit events must be in the raw format.
62
63       --summary
64              Print  a  summary  with  information about the events found. The
65              summary contains the considered range of  time,  the  number  of
66              guest  starts and stops, the number of resource assignments, the
67              number of AVC and anomaly events, and the number of failed oper‐
68              ations.
69
70       -te, --end [end-date] [end-time]
71              Search  for events with time stamps equal to or before the given
72              end time. The format of end time depends on your locale. If  the
73              date  is  omitted, today is assumed. If the time is omitted, now
74              is assumed. Use 24 hour clock time rather than AM or PM to spec‐
75              ify  time.   An  example  date  using  the  en_US.utf8 locale is
76              09/03/2009. An example of time  is  18:00:00.  The  date  format
77              accepted is influenced by the LC_TIME environmental variable.
78
79              You  may  also  use  the  word:  now,  recent, today, yesterday,
80              this-week, week-ago, this-month, this-year. Today means starting
81              now.  Recent is 10 minutes ago. Yesterday is 1 second after mid‐
82              night the previous day.  This-week means starting 1 second after
83              midnight  on  day  0  of the week determined by your locale (see
84              localtime). This-month means 1 second after midnight on day 1 of
85              the  month.  This-year  means the 1 second after midnight on the
86              first day of the first month.
87
88       -ts, --start [start-date] [start-time]
89              Search for events with time stamps equal to or after  the  given
90              end  time. The format of end time depends on your locale. If the
91              date is omitted, today is assumed. If the time is omitted,  mid‐
92              night is assumed. Use 24 hour clock time rather than AM or PM to
93              specify time. An example date using  the  en_US.utf8  locale  is
94              09/03/2009.  An  example  of  time  is 18:00:00. The date format
95              accepted is influenced by the LC_TIME environmental variable.
96
97              You may also  use  the  word:  now,  recent,  today,  yesterday,
98              this-week,  this-month,  this-year.   Today  means starting at 1
99              second after midnight. Recent is 10 minutes ago. Yesterday is  1
100              second  after midnight the previous day.  This-week means start‐
101              ing 1 second after midnight on day 0 of the week  determined  by
102              your  locale  (see  localtime).  This-month means 1 second after
103              midnight on day 1 of the month. This-year  means  the  1  second
104              after midnight on the first day of the first month.
105
106       -u, --uuid  UUID
107              Only show events related to the guest with the given UUID.
108
109       -v, --vm  name
110              Only show events related to the guest with the given name.
111
112

EXAMPLES

114       To see all the records in this month for a guest
115
116       auvirt --start this-month --vm GuestVmName --all-events
117
118

SEE ALSO

120       aulast(8), ausearch(8), aureport(8).
121
122

AUTHOR

124       Marcelo Cerri
125
126
127
128IBM Corp                           Dec 2011                          AUVIRT(8)
Impressum