/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

3 votes172 views2 answers
Create a sudo user in centos 7
Shell/Bash
0 vote185 views1 answer
Powershell add to env path
Shell/Bash
0 vote159 views1 answer
Cheese not found,
Shell/Bash
0 vote176 views1 answer
Git rebase based on commit
Shell/Bash
0 vote177 views1 answer
"serverless-prune-plugin" not found.
Shell/Bash
0 vote170 views2 answers
Download python-dev
Shell/Bash
1 vote191 views1 answer
ArgumentError: Malformed version number string 0.32+git
Shell/Bash
0 vote177 views1 answer
Clock skew detected github
Shell/Bash
1 vote152 views1 answer
Get windows service name cmd
Shell/Bash
0 vote228 views1 answer
How to install audacity in fedora 34
Shell/Bash