VERY basic question

Hi all. I 've been lurking around, listening for things I can use...but I'm not where you guys are at in terms of auditing. I still have a requirement, however. So, help me to understand a very basic functioning of Linux (I imagine its basic). In a standalone system: How in the world do I capture, create and save human readable reports and then clear audit logs. Which BASIC /var/log should every accidental sysad (like myself) be capturing? I know where to put the audit rules, but at this point, I'm just sort of following instructions for that without any real sense of understanding. The farthest I've gotten is -w means watch. If you guys would take a moment to ask such a rudimentary question, I might be able to move past go. Thank you for your time. Margaret M. Sanders SwRI ISSO/ATA