On Wednesday, February 12, 2020 5:01:37 AM EST MAUPERTUIS, PHILIPPE wrote: > Like many, we are using aide and clamav. > I woud like to have an audit record when these program are run but no > records for what they are doing. I mean, I want to know that clamscan or > aide has been launched but not that it checks say /etc/passwd whatever > rules could be in place for /etc/passwd
Then all you need to do is place a watch on them. -a always,exit -F path=path-to-aide -F perm=x -F key=something-ran -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
