I've noticed one of the headless computers in my network is constantly polling the VNC port on another computer. My problem is, that when I see the port from which it has connected (with tcpdump) and try to find the process with netstat -anp|grep PORT, the process is already killed and nothing is found (the process seems to live for less than a millisecond).

Is there something similar to tcpdump that would report process names & PIDs? Or some smart way of doing strace to capture the program?


Try auditctl, it will help. Enabling below rule can flood your system so use just form debugging.

auditctl -a exit,always -S execve

reference : https://linux.die.net/man/8/auditctl

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.