/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote335 views1 answer
Enable usb port ubuntu
Shell/Bash
0 vote368 views1 answer
Mac install vagrant
Shell/Bash
3 votes327 views2 answers
Use a specific version of node
Shell/Bash
-2 votes324 views1 answer
Rm permission denied
Shell/Bash
0 vote334 views1 answer
New git
Shell/Bash
0 vote316 views1 answer
How to clear gradle cache gitignore
Shell/Bash
0 vote302 views1 answer
Minikube without sudo
Shell/Bash
0 vote353 views1 answer
How to push forcefully in github
Shell/Bash
0 vote299 views1 answer
Linux set -x
Shell/Bash
0 vote335 views1 answer
Check git settings terminal
Shell/Bash