Where does Solaris 10 keep a log of pfexec attempts?

Question

I assigned a user the "User Security" profile so that they could reset user passwords and unlock accounts.

Does Solaris keep a record of whenever users execute pfexec?

I didn't see any records in /var/adm/messages. I didn't see anything in the audit logs using praudit <audit_log_file> | grep pfexec.

Answer 1

Found it logged under audit class as. Then using:

auditreduce -c as <audit_log_file> | praudit | grep "profile command"