Man pages › Compared with Linux and the BSDs

`praudit(8)` on Solnix vs Linux and the BSDs

On Solnix, praudit is the illumos praudit at /usr/sbin/praudit, in manual section 8. It prints audit trail files in the audit.log(5) format. The biggest trap for FreeBSD users is that -p takes a filename on Solnix. On FreeBSD, -p takes no argument and is for input piped from tail(1).

The manual pages

Solnix: praudit(8) from pkgs.solnix.illumos-world-man · illumos.org
FreeBSD: praudit(1) 15.1-RELEASE

What Solnix runs

A default Solnix system runs the illumos praudit at /usr/sbin/praudit. No other variants are shipped. The bundle has a counterpart page only for FreeBSD (OpenBSM). It has none for Linux, OpenBSD or NetBSD, so this page makes no claims about them. Solnix documents the command stability as evolving and the output format as unstable.

Differences

Compared with	Topic	What differs
FreeBSD	`-p` meaning	Solnix `-p` filename reads passwd entries from that file to resolve UIDs to user names. FreeBSD `-p` takes no argument and makes praudit sync to the start of the next record when input is piped from tail(1). The same flag does different jobs. Source: Solnix praudit(8) -p filename; FreeBSD praudit(1) -p
FreeBSD	`-g` and offline ID resolution	Solnix `-g` filename resolves GIDs from a copied group file, and `-p` filename resolves UIDs from a copied passwd file. This is meant for analysing logs gathered from other hosts. FreeBSD has no `-g` and no file-taking `-p`. Source: Solnix praudit(8) -g filename, -p filename; FreeBSD praudit(1) SYNOPSIS
FreeBSD	`-n` missing on Solnix	FreeBSD `-n` leaves user and group IDs numeric. Solnix has no `-n`. Its `-r` prints times, UIDs, GIDs, record types and events all as integers, and `-g`/-p change how IDs are resolved. Source: FreeBSD praudit(1) -n; Solnix praudit(8) SYNOPSIS, -r, -g, -p
FreeBSD	`-l` line layout	Solnix `-l` prints one line per record. FreeBSD `-l` prints the entire record on one line, and without `-l` every token is on its own line. The Solnix page does not state its default layout without `-l`. Source: Solnix praudit(8) -l; FreeBSD praudit(1) -l
FreeBSD	`-d` delimiter	Both default to a comma. Solnix writes the option as `-ddel`, limits the delimiter to three characters, and ignores it with `-x`. The FreeBSD page states no length limit and does not say what `-x` does with the delimiter. Source: Solnix praudit(8) -ddel; FreeBSD praudit(1) -d del
FreeBSD	`-r` with `-s`	Both pages say `-r` and `-s` are mutually exclusive. Solnix adds that using both produces a format usage error message. The FreeBSD page does not say what happens. Source: Solnix praudit(8) -r, -s; FreeBSD praudit(1) -r, -s
FreeBSD	name lookup source	Solnix `-s` looks up numeric fields through the sources in `/etc/nsswitch.conf.` `-r` is meant for when naming services are offline. FreeBSD says events are shown per `/etc/security/audit_event` and does not mention a naming-service configuration. Source: Solnix praudit(8) -r, -s; FreeBSD praudit(1) DESCRIPTION (last paragraph)
FreeBSD	file count limit	Solnix accepts at most 100 audit files on the command line. The FreeBSD page states no such limit. Source: Solnix praudit(8) DESCRIPTION; FreeBSD praudit(1) SYNOPSIS
FreeBSD	exit status	FreeBSD documents exit 0 on success and >0 on error. The Solnix page has no exit status section, so scripts should not rely on specific nonzero values there. Source: FreeBSD praudit(1) EXIT STATUS; Solnix praudit(8) (no such section)
FreeBSD	manual section	The page is praudit(8) on Solnix, in the system administration section, and praudit(1) on FreeBSD. Use man 8 praudit on Solnix. The binary is at `/usr/sbin/praudit.` Source: Solnix praudit(8) header; FreeBSD praudit(1) header

Standards

POSIX: praudit is not a POSIX.1-2024 utility.
Solnix: ATTRIBUTES: the command stability is evolving. The output format is unstable.
FreeBSD: The page has no STANDARDS section. HISTORY says the OpenBSM implementation was created by McAfee Research under contract to Apple Computer Inc. in 2004.

Writing portable scripts

Do not use -p or -n in scripts meant for both Solnix and FreeBSD: -p means different things, and Solnix has no -n.
Do not parse the default text output across systems. The Solnix output format is documented as unstable. -x exists on both, but the pages do not say the XML matches.

Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.