How can I pull the timestamp from a particular audit event. For example: I want to pull all /bin/su events from the audit log for the week with when they occurred. How can I do this?

Thanks

David A. Kirkwood