How to track process invocation history using audit

[Steve Grubb]

On Monday, June 20, 2011 11:51:10 AM Kohei KaiGai wrote:
> I tried to track all the fork(2) system call to record relationship
> between ppid and pid
> on processes with a particular loginuid.
> 
>   [root at ls3029v0 ~]# auditctl -a task,always -F arch=b64 -S fork -F
> auid=1234 Error: syscall auditing being added to task list

Maybe you need to use the clone syscall? You can probably strace a program just to 
make sure what its using.

-Steve