1AUTRACE(8)              System Administration Utilities             AUTRACE(8)
2
3
4

NAME

6       autrace - a program similar to strace
7

SYNOPSIS

9       autrace program [-r] [program-args]...
10

DESCRIPTION

12       autrace  is  a program that will add the audit rules to trace a process
13       similar to strace. It will then execute the program  passing  arguments
14       to it. The resulting audit information will be in the audit logs if the
15       audit daemon is running or syslog. This command deletes all audit rules
16       prior  to  executing  the  target  program and after executing it. As a
17       safety precaution, it will not run unless all rules  are  deleted  with
18       auditctl prior to use.
19

OPTIONS

21       -r     Limit  syscalls  collected to ones needed for analyzing resource
22              usage. This could help people doing threat modeling. This  saves
23              space in logs.
24

EXAMPLES

26       The following illustrates a typical session:
27
28       autrace /bin/ls /tmp
29       ausearch --start recent -p 2442 -i
30
31       and for resource usage mode:
32
33       autrace -r /bin/ls
34       ausearch --start recent -p 2450 --raw | aureport --file --summary
35       ausearch --start recent -p 2450 --raw | aureport --host --summary
36
37

SEE ALSO

39       ausearch(8), auditctl(8).
40
41

AUTHOR

43       Steve Grubb
44
45
46
47Red Hat                            Jan 2007                         AUTRACE(8)