That’s it! this way you can trace and audit specific Linux process using autrace tool, for more information check man pages. To produce a report for only today’s records, use the -ts ausearch flag to specify the start date/time for searching: # ausearch -ts today -p 2678 -raw | aureport -i -f

# autrace -r /usr/bin/df -hĪssuming you have autraced a program for the last one week meaning there is a lot of information dumped in the audit logs.

-i – allows interpreting of numeric values into text.Īnd using the command below, we are limiting the syscalls gathered to ones needed for analyzing resource usage of the df process.

-f – enables reporting about files and af_unix sockets.

-raw – tells ausearch to deliver raw input to aureport.

To generate a report about the trace details, you can build a command line of ausearch and aureport like this.

-p – passes the process ID to be searched.

-i – enables interpreting of numeric values into text.

# autrace /usr/bin/df -hįrom the screenshot above, you can find all the log entries to do with the trace, from the audit log file using ausearch utility as follows. In this example, we are tracing the execution of df command, which shows filesystem usage. Then proceed to run autrace with your target program. # autrace /usr/bin/dfįirst delete all the auditd rules with the following command. If you have any audit rules present, autrace shows the following error.

Because using this form, the program you run will assume you’re using one of its internal option thus resulting into an error or performing the default action enabled by the option. Attention: In the autrace man page, the syntax as follows, which is actually a documentation mistake.

Arch linux process monitor