/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

1 vote372 views1 answer
Not digitally signed
Shell/Bash
9 votes327 views5 answers
Get all branches from remote
Shell/Bash
21 votes347 views6 answers
Install composer in ubuntu
Shell/Bash
0 vote351 views2 answers
Linux autohide cursor
Shell/Bash
5 votes364 views2 answers
Kill all processes by name cmd
Shell/Bash
1 vote323 views1 answer
Stackoverflow most popular question
Shell/Bash
0 vote359 views1 answer
Run xammp
Shell/Bash
0 vote377 views1 answer
Install freetype globally on ubuntu
Shell/Bash
0 vote326 views1 answer
Top show specific pid
Shell/Bash
1 vote342 views1 answer
Blutooth won't turn on kali linux
Shell/Bash