/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

1 vote347 views2 answers
Git Automatic merge failed; fix conflicts and then commit the result
Shell/Bash
0 vote350 views1 answer
Ubuntu terminal autocomplete not working
Shell/Bash
2 votes355 views1 answer
Bash sort by column
Shell/Bash
4 votes335 views3 answers
Get length of array bash
Shell/Bash
0 vote332 views2 answers
Docker-compose build context tag own name
Shell/Bash
0 vote349 views1 answer
Docker buildx build --platform linux/amd64,linux/arm64 -t username/application:latest --push .
Shell/Bash
6 votes344 views1 answer
Date-fns npm package
Shell/Bash
0 vote355 views1 answer
Ubuntu 20.04 wifi adapter not found dell
Shell/Bash
2 votes369 views6 answers
Git status
Shell/Bash
0 vote361 views1 answer
Kubernetes using hyper v
Shell/Bash