/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote225 views1 answer
Video editor for ubuntu 21.10
Shell/Bash
6 votes237 views1 answer
Remove openshot ubuntu
Shell/Bash
3 votes198 views1 answer
Npm install from github branch
Shell/Bash
0 vote225 views1 answer
Convert epoch time on mac to human readable
Shell/Bash
0 vote234 views1 answer
Openssl ubuntu random string generator
Shell/Bash
0 vote233 views1 answer
Bash tr squeeze space
Shell/Bash
2 votes209 views1 answer
Bash strip preceeding white space
Shell/Bash
61 votes246 views6 answers
Revert last commit
Shell/Bash
0 vote251 views1 answer
Install pecl on mac
Shell/Bash
1 vote207 views1 answer
Kubectl top pod
Shell/Bash