AUTRACE(8)

📦 version 3.1.5, in centos-stream 9, debian bookworm, ubuntu jammy, ubuntu noble

💖 AUTRACE(8) 💖

System Administration Utilities — and bestie, this one is literally the strace-adjacent icon you've been looking for.

✨ NAME ✨

autrace — a program similar to strace 🦋

🌸 SYNOPSIS 🌸

autrace program [-r] [program-args]...

🎀 DESCRIPTION 🎀

okay so picture this: autrace is a program that adds the audit rules to trace a process, kind of like strace does, but make it audit-flavored. it will then execute the program, passing arguments to it. 💅

the resulting audit information will land in the audit logs if the audit daemon is running, or in syslog. no cap.

now here's the part where you gotta pay attention, bestie: this command deletes all audit rules prior to executing the target program and also after executing it. it's very much a "clean slate, periodt" situation.

and as a safety precaution, it will not run unless all rules are deleted with auditctl prior to use. so like, do your little pre-game ritual first or it's simply not happening. 🫶

💅 OPTIONS 💅

  • -r — limit syscalls collected to ones needed for analyzing resource usage. this could help people doing threat modeling (main character energy fr fr). it also saves space in logs. 🍓

🌈 EXAMPLES 🌈

the following illustrates a typical session:

autrace /bin/ls /tmp
ausearch --start recent -p 2442 -i

and for resource usage mode:

autrace -r /bin/ls
ausearch --start recent -p 2450 --raw | aureport --file --summary
ausearch --start recent -p 2450 --raw | aureport --host --summary

👑 SEE ALSO 👑

ausearch(8), auditctl(8).

🧚 AUTHOR 🧚

Steve Grubb

and that's the whole vibe check, bestie ✨ this page comes to you from Red Hat, dated Jan 2007 — yes, she's an elder icon and she still ate. go trace something cute. 💜🎀
📦 where this page comes from