I'm wondering how to configure auditd to capture redirection of the command, e.g.:

mycommand arg1 arg2 > myfile

will result in only the following information within auditd logs:

    "title": "mycommand arg1 arg2",
    "args": ["mycommand", "arg1", "arg2"]

Can someone suggest how to adjust either the daemon configuration or the ruleset?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.