From c29148d5f994fe056ac93ac5cba56143267d4da9 Mon Sep 17 00:00:00 2001 From: Michael Preisach Date: Tue, 11 Aug 2020 09:38:54 +0200 Subject: [PATCH] fixed typo in Readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a4a10a5..ffa3a7d 100644 --- a/README.md +++ b/README.md @@ -139,7 +139,7 @@ time find / -fstype ext4 -type f -uid 0 -exec dd if='{}' of=/dev/null count=0 st ## Syscall logging with auditd auditd is able to log every single syscall of a process. -1. `autrace [-r] path/to/executable -with -args` +1. `autrace [-r] /path/to/executable -with -args` 2. When the executable is finished, it returns a pid number 3. `ausearch -i -p > /path/to/auditlog` saves then the complete audit log to a file. 4. find all accessed files with