/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

1 vote345 views1 answer
How to open new terminal in ubuntu
Shell/Bash
3 votes383 views3 answers
Switch zsh to bash
Shell/Bash
9 votes322 views1 answer
Install steam on chromebook
Shell/Bash
0 vote382 views1 answer
Relocating shards stuck elasticsearch
Shell/Bash
15 votes364 views4 answers
Sass
Shell/Bash
11 votes354 views3 answers
Appimage install kali linux
Shell/Bash
0 vote337 views1 answer
Fastp github
Shell/Bash
1 vote352 views1 answer
Capacitor resources
Shell/Bash
4 votes344 views2 answers
Ubuntu settings not opening 20.04
Shell/Bash
0 vote335 views1 answer
How to restart mongodb server in ubuntu
Shell/Bash