/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote289 views2 answers
How to reduce the size of an image in linux
Shell/Bash
1 vote286 views2 answers
Git set commit date
Shell/Bash
0 vote271 views1 answer
How to pull apk of any app through adb
Shell/Bash
4 votes277 views2 answers
Convert pem to ppk ubuntu
Shell/Bash
3 votes262 views1 answer
Pacman remove unused dependencies
Shell/Bash
0 vote277 views1 answer
How to find files and copy them in terminal
Shell/Bash
7 votes296 views2 answers
Linux format usb command line
Shell/Bash
1 vote291 views2 answers
Mac unzip terminal
Shell/Bash
2 votes247 views1 answer
Update grub archlinux
Shell/Bash
2 votes262 views2 answers
Vite
Shell/Bash