How do I determine what user or process is mounting or unmounting devices with auditd?
Issue
- How do I determine what user or process is mounting or unmounting devices with auditd?
- Enable auditctl to monitor when an unmount operation is performed and make it persistent across reboot
Environment
- Red Hat Enterprise Linux
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
