How to find out what executed a program or modified a file on the system
Updated -
In this article, we will demonstrate how to find out what triggered the execution of a given program (e.g. systemctl daemon-reload) and what triggered the modification of the permissions on a given file.
There are mostly 2 simple methods to achieve this, either using some specific audit rules, or through using a systemtap script; both methods have their own...
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
