Re: How to monitor only when a binary is launched

Aide or clamscan are analyzing all the files on the system thus generating a lot of messages They are binaries that I can trust so I can exclude their activity from auditd. I know that I can do this with -a never,exit -F arch=b64 -F exe=/sbin/aide However I would like to have an entry for the execution of the binary itself with the parameters used. I would like to turn off only the report of the syscall it issued . Is there a general way to achieve that : record the launch of a binary but not its actions.