Auditctl

From wikinotes

Audit the linux kernel behaviour.

Examples

Audit TCP connections

auditctl -A exit,always -S connect  # install log
auditctl -d exit,always -S connect  # uninstall log
Retrieved from "http://willpittman.net:8080/index.php?title=Auditctl&oldid=18113"