Is there a rule for auditing all processes' syscall info?

Marius.bao

Friday, 28 December 2007 Fri, 28 Dec '07

7:30 p.m.

Hi all, We can use a rule to audit one specific process's all syscall info, eg: auditctl -a entry,always -S all -F pid=1005, it will log process 1005's syscall info. Is there a rule available to audit all processes' syscall info? Thanks in advance.

Attachments:

attachment.html (text/html — 301 bytes)

Back to the thread

Back to the list