/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

2 votes269 views2 answers
Dexie nuxt
Shell/Bash
0 vote279 views1 answer
How to install baeutiful soap
Shell/Bash
0 vote490 views1 answer
Stop openhab2 service
Shell/Bash
2 votes269 views2 answers
Ffmpeg scale but keep aspect ratio
Shell/Bash
1 vote291 views2 answers
Git no ssl
Shell/Bash
1 vote221 views1 answer
Move word backwards console unix
Shell/Bash
0 vote264 views1 answer
Renaming heroku remotes
Shell/Bash
0 vote271 views1 answer
Most git libya
Shell/Bash
4 votes254 views2 answers
Djanog shell change password
Shell/Bash
0 vote247 views2 answers
Install php-fpm
Shell/Bash