Need to get parent process and/or user of curl that, I know, starts from time to time on some server.
Audit is used by others, so I can not trivialy configure it. Is there any other tools?
Asked
Active
Viewed 17 times
0
-
Why not `audit`? You can just add one more rule. Something like can do the work: `auditctl -a always,exit -F exe=/bin/curl -F arch=b64 -S execve -k curl_exec` – Romeo Ninov Apr 27 '23 at 14:31