/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

14 votes194 views1 answer
Pip installer for mac
Shell/Bash
1 vote208 views1 answer
How to find all the dir in current working directory in linux
Shell/Bash
8 votes190 views3 answers
Search tag git
Shell/Bash
4 votes192 views2 answers
Unable to snap ubuntu software
Shell/Bash
0 vote196 views2 answers
How to remove package files in linux
Shell/Bash
1 vote224 views1 answer
Cordova ios 5.1.0
Shell/Bash
1 vote261 views2 answers
Npm install strapi
Shell/Bash
1 vote182 views1 answer
Open jupyter notebook with anaconda in powershell
Shell/Bash
0 vote179 views1 answer
Install winrt
Shell/Bash
5 votes194 views3 answers
Debian uninstall package
Shell/Bash