/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote357 views1 answer
Sexy bash
Shell/Bash
7 votes295 views5 answers
Expo build android
Shell/Bash
0 vote309 views1 answer
Fastp github
Shell/Bash
3 votes360 views2 answers
Start stop restart pm2
Shell/Bash
0 vote320 views1 answer
Install onenote in ubuntu
Shell/Bash
1 vote303 views8 answers
How to install anbox on ubuntu 18.04
Shell/Bash
0 vote318 views1 answer
Sudo doesnt work on windows
Shell/Bash
2 votes380 views1 answer
Settings not opening in ubuntu 18.04
Shell/Bash
4 votes311 views2 answers
How to uninstall git
Shell/Bash
5 votes331 views3 answers
Docker why my container start on reboot
Shell/Bash