On Monday, June 20, 2011 11:51:10 AM Kohei KaiGai wrote: > I tried to track all the fork(2) system call to record relationship > between ppid and pid > on processes with a particular loginuid. > > [root@ls3029v0 ~]# auditctl -a task,always -F arch=b64 -S fork -F > auid=1234 Error: syscall auditing being added to task list
Maybe you need to use the clone syscall? You can probably strace a program just to make sure what its using. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
