/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote273 views1 answer
Get sentence in folder
Shell/Bash
0 vote286 views1 answer
Chnage the password of user n linu
Shell/Bash
2 votes262 views1 answer
Readmemd img
Shell/Bash
0 vote269 views2 answers
Windows terminal guid
Shell/Bash
0 vote277 views2 answers
Linux cut
Shell/Bash
0 vote296 views1 answer
Apache virtual host file
Shell/Bash
0 vote285 views1 answer
Venv git
Shell/Bash
6 votes255 views5 answers
Add label to pod kubectl
Shell/Bash
0 vote261 views1 answer
How to install curl in centos 7
Shell/Bash
0 vote280 views1 answer
Failed to start firewalld - dynamic firewall daemon.
Shell/Bash