At times, you may need to recover audit data from the audit buffer(s) in main memory. You can use the abuf function of the crash command to recover audit data from the buffer(s). See crash(1M) for more information.