How to filter PROCTITLE events

[杨海]

Hi


I am looking for the method to filter the PROCTITLE events via auditctl.


It is said we can do it, but I could not figure out how.
"The proctitle event is emitted during syscall audits, and can be filtered with auditctl."



Regards
Hai
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190724/66fc1adb/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 05F306BC at 0426F11D.9F24385D.jpg
Type: image/jpeg
Size: 13628 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190724/66fc1adb/attachment.jpg>