I can doauditctl -a always,exit -S all -F pid=1234To log all the system calls done by pid 1234 and:auditctl -a always,exit -S all -F ppid=1234For its children, but how do I cover the grand-children and their children as well (current and future)?I cannot rely on (e)uid/(e)gid that do change.(note that using strace is not an option either)
How to log all system calls made by a process and all its descendants with auditd
linux;audit;linux audit