auditd snippet for fsync capture

ringerc · ringerc · commit d417b36aa41d · 2024-06-08T22:25:09.000+12:00
diff --git a/misc/auditd/audit_fsync/audit_fsync.sh b/misc/auditd/audit_fsync/audit_fsync.sh
@@ -0,0 +1,2 @@
+#!/bin/bash
+sudo auditctl -a exit,always -F arch=b64 -S fsync -k audit_fsync

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+#!/bin/bash`
	`2`	`+sudo auditctl -a exit,always -F arch=b64 -S fsync -k audit_fsync`