I know I can view the open files of a process using
lsof at that moment in time on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when monitoring it using standard shell scripting (e.g.
watch) as explained in "monitor open process files on linux (real-time)".
So, I think I'm looking for a simple way of auditing a process and see what it has done over the time passed. It would be great if it's also possible to see what network connections it (tried to) make and to have the audit start before the process got time to run without the audit being started.
Ideally, I would like to do this:
sh $ audit-lsof /path/to/executable 4530.848254 OPEN read /etc/myconfig 4530.848260 OPEN write /var/log/mylog.log 4540.345986 OPEN read /home/gert/.ssh/id_rsa <-- suspicious 4540.650345 OPEN socket TCP ::1:34895 -> 184.108.40.206:80 | [...] 4541.023485 CLOSE /home/gert/.ssh/id_rsa <-- would have missed 4541.023485 CLOSE socket TCP ::1:34895 -> 220.127.116.11:80 | this when polling
Would this be possible using
strace and some flags to not see every system call?