How do I determine what user or process is mounting or unmounting devices with auditd?

Solution Verified - Updated -

Issue

  • How do I determine what user or process is mounting or unmounting devices with auditd?
  • Enable auditctl to monitor when an unmount operation is performed and make it persistent across reboot

Environment

  • Red Hat Enterprise Linux

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In