/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

1 vote294 views1 answer
Cloning kali-anonsurf in linux
Shell/Bash
4 votes313 views3 answers
Git pull from previous commit
Shell/Bash
6 votes332 views3 answers
Change name of branch github
Shell/Bash
1 vote282 views1 answer
Vlc not opening any video in ubuntu
Shell/Bash
2 votes316 views1 answer
Yarn 2 outdated packages
Shell/Bash
0 vote296 views1 answer
Angular localize install
Shell/Bash
0 vote324 views1 answer
Git tls certificate verification has been disabled
Shell/Bash
0 vote288 views1 answer
How to check if cyberduck is installed
Shell/Bash
0 vote325 views1 answer
Composer install fast download
Shell/Bash
86 votes313 views3 answers
Conda create a virtual enviroment
Shell/Bash