On Sunday, June 20, 2021 4:42:48 PM EDT Muthamilan Sargunaanandan wrote: > I would like to add the Internal commands (example cd , |, > and etc) track > in AuditD.
Internal to what? Auditd just logs events to disk. The kernel is what decides what should be logged. The kernel's view is pretty much what you'd see in strace output. If there is something in the strace that is significant, a syscall rule can be written for it. > Can I get the auditd rules to trace the user commands including the > internal commands. The kernel doesn't have visibility into the meaning of anything users do. But what it can do is record any keystrokes that a user may type regardless of what program is receiving the characters. You can look into pam_tty_audit if you want to do that. It will record these as TTY events that you can later post process -Steve -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
