/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote324 views1 answer
Get pytorch version version in ubuntu
Shell/Bash
-1 vote315 views1 answer
Hot to remove all the extensions from vs code
Shell/Bash
0 vote302 views1 answer
Run camunda in linux mint
Shell/Bash
10 votes337 views4 answers
Bash install kubectl
Shell/Bash
8 votes361 views1 answer
File search linux by text
Shell/Bash
0 vote344 views3 answers
Install google drive on ubuntu
Shell/Bash
0 vote370 views1 answer
Connect-session-sequelize installation
Shell/Bash
61 votes353 views6 answers
Kill process on port windows
Shell/Bash
1 vote289 views1 answer
Git revert to commit hash
Shell/Bash
16 votes329 views3 answers
Uninstall npm ubuntu
Shell/Bash