/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote282 views1 answer
Git log with simple graph
Shell/Bash
0 vote342 views1 answer
Godaddy ssl integration to the ubuntu apache
Shell/Bash
1 vote277 views1 answer
Bash list processes mac
Shell/Bash
5 votes284 views2 answers
Unable to resolve reference git
Shell/Bash
46 votes307 views6 answers
Create-react-app typescript
Shell/Bash
3 votes278 views1 answer
How to install gh-pages
Shell/Bash
0 vote274 views1 answer
Install pup command mac
Shell/Bash
29 votes294 views6 answers
Linux install nvm
Shell/Bash
0 vote275 views1 answer
Loop clear and ls lrt command line linux
Shell/Bash
3 votes301 views1 answer
Error starting daemon: error while opening volume store metadata database: timeout
Shell/Bash