Answers for "ubuntu auditd rule for PID process"

Shell/Bash

0

ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Posted by: Guest on March-31-2021

Source

Code answers related to "ubuntu auditd rule for PID process"

Code answers related to "Shell/Bash"

Browse Popular Code Answers by Language

Python

Javascript

Whatever

Shell/Bash

CSS

Html

PHP

SQL

Java

C#