0

I'm wondering how to configure auditd to capture redirection of the command, e.g.:

mycommand arg1 arg2 > myfile

will result in only the following information within auditd logs:

"process": 
    "title": "mycommand arg1 arg2",
    "args": ["mycommand", "arg1", "arg2"]
...

Can someone suggest how to adjust either the daemon configuration or the ruleset?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.