/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

21 votes333 views4 answers
Git clone submodule
Shell/Bash
20 votes314 views5 answers
Yarn remove package
Shell/Bash
0 vote331 views1 answer
Install Spotify on zzUbuntu
Shell/Bash
3 votes316 views1 answer
Ffmpeg add two videos together
Shell/Bash
0 vote300 views1 answer
Sed up to first match
Shell/Bash
96 votes309 views6 answers
How to uninstall npm packages
Shell/Bash
11 votes354 views3 answers
Macos install yarn
Shell/Bash
1 vote328 views1 answer
Grep after match
Shell/Bash
1 vote323 views1 answer
Ls display chmod number
Shell/Bash
0 vote301 views1 answer
Shell themes for ubuntu
Shell/Bash