/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

4 votes213 views2 answers
Grep but exclude directory
Shell/Bash
0 vote233 views1 answer
PowerShell show calendar
Shell/Bash
0 vote212 views1 answer
Flatpak list themes
Shell/Bash
1 vote215 views1 answer
Git commit with subject and body
Shell/Bash
0 vote210 views1 answer
Ubuntu facial recognition login
Shell/Bash
1 vote210 views1 answer
Create next typscript with yarn
Shell/Bash
0 vote211 views1 answer
Jekyll serve fails on Ruby 3.0
Shell/Bash
1 vote210 views1 answer
How to install nvm on linux terminal
Shell/Bash
85 votes226 views4 answers
Change git commit message
Shell/Bash
0 vote209 views1 answer
Install python 3.10 on raspberry pi
Shell/Bash