Auditd

https://unix.stackexchange.com/questions/84847/is-there-an-easy-way-to-log-all-commands-executed-including-command-line-argume

https://docs.redhat.com/fr/documentation/red_hat_enterprise_linux/9/html/security_hardening/proc_monitoring-user-login-times-with-audit_auditing-the-system

https://izyknows.medium.com/linux-auditd-for-threat-detection-d06c8b941505

https://izyknows.medium.com/linux-auditd-for-threat-hunting-part-2-c75500f591e8

Auditd is a draft article and may contain little or no information. The article will not be published on A Voice for Men or appear in random article selections. Wiki4Men is looking for trustworthy editors that can turn draft articles in to featured articles. Information on how to apply is on the Main Page.

Notes

Technical articles in this category are applicable to Linux. Debian GNU/Linux is used in examples. Much of the information is also applicable to other Linux distributions and Unix flavours.