/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

3 votes239 views1 answer
Keycloak docker
Shell/Bash
0 vote211 views1 answer
Ansible copy
Shell/Bash
0 vote242 views1 answer
Delete all containers created x hours ago
Shell/Bash
41 votes248 views6 answers
Stop apache service
Shell/Bash
2 votes235 views2 answers
How to install flutter linux
Shell/Bash
17 votes243 views4 answers
Install ionic globally
Shell/Bash
0 vote218 views1 answer
Git clone and change the folder name
Shell/Bash
0 vote254 views2 answers
GVfs metadata is not supported. Fallback to TeplMetadataManager.
Shell/Bash
1 vote221 views1 answer
Awk how to print without adding spaces between fields
Shell/Bash
1 vote247 views2 answers
Linux set alternatives /etc/alternatives
Shell/Bash