/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

20 votes246 views1 answer
Install homebrew git mac
Shell/Bash
1 vote247 views1 answer
How to install open media vault on raspberry pi
Shell/Bash
0 vote256 views1 answer
Chmod using find in bash
Shell/Bash
0 vote256 views1 answer
How delete wireless connection raspberry pi terminal
Shell/Bash
1 vote255 views1 answer
Mate-polkit-bin for ubuntu
Shell/Bash
1 vote235 views1 answer
Swapping of two numbers without using third variable in shell script
Shell/Bash
2 votes257 views1 answer
Git switch vs checkout
Shell/Bash
24 votes248 views5 answers
Kill localhost 3000 ubuntu
Shell/Bash
5 votes254 views2 answers
Git default remote
Shell/Bash
4 votes253 views2 answers
Install yarm for redhat linux
Shell/Bash