/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

1 vote116 views2 answers
Debian install git server
Shell/Bash
0 vote126 views3 answers
Open rdp port windows 10 using command line
Shell/Bash
6 votes121 views3 answers
What is local repository
Shell/Bash
15 votes128 views1 answer
See ubunut environment variables
Shell/Bash
21 votes107 views4 answers
Ubuntu get process on port
Shell/Bash
2 votes123 views3 answers
Disable ufw
Shell/Bash
3 votes110 views2 answers
Git not using ssh key
Shell/Bash
0 vote125 views1 answer
Como hacer para loguearse en git en visual
Shell/Bash
2 votes105 views1 answer
Bison install ubuntu
Shell/Bash
0 vote128 views1 answer
Install specific gitlab version on ubuntu
Shell/Bash