Auditing a program use but not what it is doing

[Steve Grubb]

On Wednesday, February 12, 2020 5:01:37 AM EST MAUPERTUIS, PHILIPPE wrote:
> Like many, we are using aide and clamav.
> I woud like to have an audit record when these program are run but no
> records for what they are doing. I mean, I want to know that clamscan or
> aide has been launched but not that it checks say /etc/passwd whatever
> rules could be in place for /etc/passwd

Then all you need to do is place a watch on them.

-a always,exit -F path=path-to-aide -F perm=x -F key=something-ran

-Steve