1AUVIRT(8) System Administration Utilities AUVIRT(8)
2
6 auvirt - a program that shows data related to virtual machines
7
10 auvirt [ OPTIONS ]
11
14 auvirt shows a list of guest sessions found in the audit logs. If a
15 guest is specified, only the events related to that guest is consid‐
16 ered. To specify a guest, both UUID or VM name can be given.
17 For each guest session the tool prints a record with the domain name,
19 the user that started the guest, the time when the guest was started
20 and the time when the guest was stopped.
21 If the option "--all-events" is given a more detailed output is shown.
23 In this mode other records are shown for guest's stops, resource as‐
24 signments, AVC and anomaly events. The first field indicates the event
25 type and can have the following values: start, stop, res, avc, and
26 anom.
27 Resource assignments have the additional fields: resource type, reason
29 and resource. And AVC records have the following additional fields: op‐
30 eration, result, command and target.
31 By default, auvirt reads records from the system audit log file. But
33 --stdin and --file options can be specified to change this behavior.
34
37 --all-events
38 Show records for all virtualization related events.
39 --debug
41 Print debug messages to stderr.
42 -f, --file file
44 Read records from the given file instead from the system audit
45 log file.
46 -h, --help
48 Print help message and exit.
49 --proof
51 Add after each event a line containing all the identifiers of
52 the audit records used to calculate the event. Each identifier
53 consists of unix time, milliseconds and serial number.
54 --show-uuid
56 Add the guest's UUID to each record.
57 --stdin
59 Read records from the standard input instead from the system au‐
60 dit log file. This option cannot be specified with --file. The
61 audit events must be in the raw format.
62 --summary
64 Print a summary with information about the events found. The
65 summary contains the considered range of time, the number of
66 guest starts and stops, the number of resource assignments, the
67 number of AVC and anomaly events, and the number of failed oper‐
68 ations.
69 -te, --end [end-date] [end-time]
71 Search for events with time stamps equal to or before the given
72 end time. The format of end time depends on your locale. If the
73 date is omitted, today is assumed. If the time is omitted, now
74 is assumed. Use 24 hour clock time rather than AM or PM to spec‐
75 ify time. An example date using the en_US.utf8 locale is
76 09/03/2009. An example of time is 18:00:00. The date format ac‐
77 cepted is influenced by the LC_TIME environmental variable.
78 You may also use the word: now, recent, today, yesterday,
80 this-week, week-ago, this-month, this-year. Today means starting
81 now. Recent is 10 minutes ago. Yesterday is 1 second after mid‐
82 night the previous day. This-week means starting 1 second after
83 midnight on day 0 of the week determined by your locale (see lo‐
84 caltime). This-month means 1 second after midnight on day 1 of
85 the month. This-year means the 1 second after midnight on the
86 first day of the first month.
87 -ts, --start [start-date] [start-time]
89 Search for events with time stamps equal to or after the given
90 end time. The format of end time depends on your locale. If the
91 date is omitted, today is assumed. If the time is omitted, mid‐
92 night is assumed. Use 24 hour clock time rather than AM or PM to
93 specify time. An example date using the en_US.utf8 locale is
94 09/03/2009. An example of time is 18:00:00. The date format ac‐
95 cepted is influenced by the LC_TIME environmental variable.
96 You may also use the word: now, recent, today, yesterday,
98 this-week, this-month, this-year. Today means starting at 1
99 second after midnight. Recent is 10 minutes ago. Yesterday is 1
100 second after midnight the previous day. This-week means start‐
101 ing 1 second after midnight on day 0 of the week determined by
102 your locale (see localtime). This-month means 1 second after
103 midnight on day 1 of the month. This-year means the 1 second af‐
104 ter midnight on the first day of the first month.
105 -u, --uuid UUID
107 Only show events related to the guest with the given UUID.
108 -v, --vm name
110 Only show events related to the guest with the given name.
111
114 To see all the records in this month for a guest
115 auvirt --start this-month --vm GuestVmName --all-events
117
120 aulast(8), ausearch(8), aureport(8).
121
124 Marcelo Cerri
125IBM Corp Dec 2011 AUVIRT(8)