Man pages › Compared with Linux and the BSDs

`auditreduce(8)` on Solnix vs Linux and the BSDs

On Solnix, auditreduce is the illumos tool at /usr/sbin/auditreduce. It merges and selects records from the audit trail directory tree, while FreeBSD's auditreduce only selects records and reads standard input when given no files. A Solnix run with no file arguments reads the whole trail under /etc/security/audit by default.

The manual pages

Solnix: auditreduce(8) from pkgs.solnix.illumos-world-man · illumos.org
FreeBSD: auditreduce(1) 15.1-RELEASE

What Solnix runs

A default Solnix system runs the illumos auditreduce at /usr/sbin/auditreduce. No other variants are shipped. The bundle has a counterpart page only for FreeBSD, so nothing is claimed here about Linux, OpenBSD or NetBSD.

Differences

Compared with	Topic	What differs
FreeBSD	default input	With no file arguments, Solnix merges the whole audit trail: all files in audit_root_dir/*/files, with audit_root_dir defaulting to `/etc/security/audit.` FreeBSD reads standard input when no file is given. Source: Solnix auditreduce(8) DESCRIPTION; FreeBSD auditreduce(1) DESCRIPTION
FreeBSD	merge function	Solnix auditreduce both merges several trail files into one chronologically ordered output and selects records. The FreeBSD page describes only record selection. Source: Solnix auditreduce(8) DESCRIPTION (merge function, select function); FreeBSD auditreduce(1) NAME, DESCRIPTION
FreeBSD	`-D` deletes input files	Solnix `-D` suffix deletes input files after a fully successful run, and implies `-A`, `-C` and `-O` suffix. The FreeBSD page documents no `-D` or any option that deletes input. Source: Solnix auditreduce(8) -D; FreeBSD auditreduce(1) SYNOPSIS
FreeBSD	`-v` and `-V`	FreeBSD `-v` inverts matching to select records that do not match. Solnix has no `-v` in its flag list; its `-V` is verbose and prints each file name as it is opened plus the total record count. Source: FreeBSD auditreduce(1) -v; Solnix auditreduce(8) -V
FreeBSD	output destination and file options	Solnix writes to standard output unless `-O` suffix is given, which writes a timestamp-named file in the audit root. The FreeBSD page has no `-O` and says matching records go to standard output in raw binary form. Source: Solnix auditreduce(8) -O; FreeBSD auditreduce(1) DESCRIPTION
FreeBSD	file location options	Solnix has `-R` (alternate audit root), `-S` (server directory), `-M` (machine suffix) and `-C` (complete files only). The FreeBSD synopsis has none of these. Files not named on the Solnix command line must follow the start-time.end-time.suffix name format. Source: Solnix auditreduce(8) -R, -S, -M, -C, Audit Trail Filename Format; FreeBSD auditreduce(1) SYNOPSIS
FreeBSD	date arguments and time zones	FreeBSD documents `-a` and `-b` as YYYYMMDD[HH[MM[SS]]] and `-d` as YYYYMMDD. Solnix takes date-time as described under Option Arguments (not in the trimmed bundle); the command-line times are local time, while trail file names are in GMT. Source: FreeBSD auditreduce(1) -a, -b, -d; Solnix auditreduce(8) -a, -d, Audit Trail Filename Format
FreeBSD	repeating options	Solnix says multiple arguments of the same type are not permitted among record selection options. FreeBSD says `-m` can be used more than once to select several event types. Source: Solnix auditreduce(8) Record Selection Options; FreeBSD auditreduce(1) -m
FreeBSD	`-N` and object selection	By default (old mode), Solnix `-e`, `-f`, `-g`, `-r` and `-u` also select objects owned by those IDs. `-N` selects actions only, and `-o` is then needed for objects. The FreeBSD page describes no such mode. Source: Solnix auditreduce(8) -N; FreeBSD auditreduce(1) -e, -f, -g, -r, -u
FreeBSD	`-c` class syntax	FreeBSD `-c` takes a comma-separated list of audit flags, documented in audit_control(5). Solnix `-c` takes audit-classes, with class names defined in audit_class(5), and the page says success and failure criteria can be used. Source: FreeBSD auditreduce(1) -c; Solnix auditreduce(8) -c
FreeBSD	zones and labels	Solnix `-R` warns not to point at a non-global zone's root file system, because that might damage the global zone. `-l` label needs Trusted Extensions. FreeBSD `-z` takes a zone glob; the trimmed Solnix text does not show what `-z` does. Source: Solnix auditreduce(8) -R note, -l; FreeBSD auditreduce(1) -z

Standards

POSIX: auditreduce is not a POSIX.1-2024 utility.

Writing portable scripts

Always pass explicit file names and check which selection options exist: -v, -z and -o object=value are FreeBSD-style, while -V, -O, -R, -S, -D and -N are Solnix-only.
Never use -D in a script without first checking its semantics: it deletes the input files on Solnix, and the FreeBSD page has no equivalent.

Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.