Skip to content

Instantly share code, notes, and snippets.

@ranvijayj

ranvijayj/gist:dec206238c4bf81613be

Created March 25, 2015 07:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ranvijayj/dec206238c4bf81613be to your computer and use it in GitHub Desktop.
Save ranvijayj/dec206238c4bf81613be to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
To see all syscalls made by a program:
auditctl -a entry,always -S all -F pid=1005
To see files opened by a specific user:
auditctl -a exit,always -S open -F auid=510
To see unsuccessful open call’s:
auditctl -a exit,always -S open -F success!=0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment