Re: How to track process invocation history using audit
On Monday, June 20, 2011 11:51:10 AM Kohei KaiGai wrote:
I tried to track all the fork(2) system call to record relationship
between ppid and pid
on processes with a particular loginuid.
[root@ls3029v0 ~]# auditctl -a task,always -F arch=b64 -S fork -F
auid=1234 Error: syscall auditing being added to task list
Maybe you need to use the clone syscall? You can probably strace a program just to
make sure what its using.
-Steve