Log all commands executed regardless of shell?
1
vote
1
answer
797
views
Suppose a user runs the following command:
zcat file.gz | grep something | gzip > grepped.gz
I'm looking for a kernel feature (a BPF filter perhaps?) that would note all of the
execve
s, chain together their stdins/stdouts and reconstruct that in a similar form, putting it into system logs. Is there a way to do that without interfacing with the shells?
Asked by d33tah
(1381 rep)
May 10, 2023, 10:45 AM
Last activity: May 10, 2023, 06:21 PM
Last activity: May 10, 2023, 06:21 PM