audit 系统调用审计

查看系统调用表：

ausyscall --dump

添加对kill系统调用的审计命令：

auditctl -a always,exit -F arch=b64 -S kill -k rule_kill_exec_command

查看audit审计日志：

tail -f /var/log/audit/audit.log

type=SYSCALL msg=audit(1549961725.237:2123): arch=c000003e syscall=62 success=yes exit=0 a0=532e a1=9 a2=0 a3=532e items=0 ppid=1980 pid=1990 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="rule_kill_exec_command"

type=OBJ_PID msg=audit(1549961725.237:2123): opid=21294 oauid=0 ouid=0 oses=1 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 ocomm="vim"

type=PROCTITLE msg=audit(1549961725.237:2123): proctitle="-bash"

参考：

https://www.cnblogs.com/pshell/p/7649189.html

https://www.cnblogs.com/bonelee/p/7803377.html

https://blog.csdn.net/shengzhadon/article/details/51567917