docs: refresh ausearch and aureport man pages

Author: stevegrubb

docs/aureport.8

@@ -1,4 +1,4 @@
-.TH AUREPORT "8" "February 2023" "Red Hat" "System Administration Utilities"
+.TH AUREPORT "8" "March 2026" "Red Hat" "System Administration Utilities"
 .SH NAME
 aureport \- a tool that produces summary reports of audit daemon logs
 .SH SYNOPSIS
@@ -27,12 +27,20 @@ Report about crypto events
 .BR \-\-debug
 Write malformed events that are skipped to stderr.
 .TP
+.BR \-\-delete
+When used with configuration, integrity, or MAC reports, only include
+delete or remove operations.
+.TP
 .BR \-\-eoe\-timeout \ \fIseconds\fP
 Set the end of event parsing timeout. See \fBend_of_event_timeout\fP in \fIauditd.conf(5)\fP for details. Note that setting this value will override any configured value found in /etc/auditd/auditd.conf.
 .TP
 .BR \-e ,\  \-\-event
 Report about events
 .TP
+.BR \-\-add
+When used with configuration, integrity, or MAC reports, only include
+add or create operations.
+.TP
 .BR \-\-escape \ \fIoption\fP
 This option determines if the output is escaped to make the content safer for certain uses. The options are \fIraw\fP , \fItty\fP , \fIshell\fP , and \fIshell_quote\fP. Each mode includes the characters of the preceding mode and escapes more characters. That is to say \fIshell\fP includes all characters escaped by \fItty\fP and adds more. \fItty\fP is the default.
 .TP

docs/ausearch.8

@@ -1,11 +1,11 @@
-.TH AUSEARCH "8" "July 2023" "Red Hat" "System Administration Utilities"
+.TH AUSEARCH "8" "March 2026" "Red Hat" "System Administration Utilities"
 .SH NAME
 ausearch \- a tool to query audit daemon logs
 .SH SYNOPSIS
 .B ausearch
 .RI [ options ]
 .SH DESCRIPTION
-\fBausearch\fP is a tool that can query the audit daemon logs based for events based on different search criteria. The ausearch utility can also take input from stdin as long as the input is the raw log data. Each commandline option given forms an "and" statement. For example, searching with \fB\-m\fP and \fB\-ui\fP means return events that have both the requested type and match the user id given. An exception is the \fB\-m\fP  and \fB\-n\fP options; multiple record types and nodes are allowed in a search which will return any matching node and record.
+\fBausearch\fP is a tool that can query the audit daemon logs for events based on different search criteria. The ausearch utility can also take input from stdin as long as the input is the raw log data. Each commandline option given forms an "and" statement. For example, searching with \fB\-m\fP and \fB\-ui\fP means return events that have both the requested type and match the user id given. An exception is the \fB\-m\fP  and \fB\-n\fP options; multiple record types and nodes are allowed in a search which will return any matching node and record.
 
 It should also be noted that each syscall excursion from user space into the kernel and back into user space has one event ID that is unique. Any auditable event that is triggered during this trip share this ID so that they may be correlated.
 
@@ -112,7 +112,7 @@ Flush output on every line. Most useful when stdout is connected to a pipe and t
 .BR \-m ,\  \-\-message \ \fImessage-type\fP\ |\ \fIcomma-sep-message-type-list\fP
 Search for an event matching the given \fImessage type\fP. (Message types are also known as record types.) You may also enter a \fIcomma separated list of message types\fP or multiple individual message types each with its own \fI-m\fP option. There is an \fBALL\fP message type that doesn't exist in the actual logs. It allows you to get all messages in the system. The list of valid messages types is long. The program will display the list whenever no message type is passed with this parameter. The message type can be either text or numeric. If you enter a list, there can be only commas and no spaces separating the list.
 .TP
-.BR \-n ,\  \-\-node
+.BR \-n ,\  \-\-node \ \fInode-name\fP
 Search for events originating from a specific machine. Multiple nodes are allowed, and if any nodes match, the event is matched. This search uses the node field in audit events. Also see the \-\-host command which search for events related to host information in the audit trail.
 .TP
 .BR \-o ,\  \-\-object \ \fISE-Linux-context-string\fP
@@ -174,7 +174,8 @@ You may also use the word: \fBnow\fP, \fBrecent\fP, \fBthis-hour\fP, \fBboot\fP,
 .na
 ausearch --checkpoint /etc/audit/auditd_checkpoint.txt -i
 _au_status=$?
-if test ${_au_status} eq 10 -o ${_au_status} eq 11 -o ${_au_status} eq 12
+if test ${_au_status} -eq 10 -o ${_au_status} -eq 11 \
+	-o ${_au_status} -eq 12
 then
   ausearch --checkpoint /etc/audit/auditd_checkpoint.txt --start checkpoint -i
 fi