I want to use audit function of Linux to audit a Linux command date -s. If I write -w /bin/date -p x -k system-call in audit.rules, it will record when I use the command date. But I don't want it to record when I use date. I only want it to record when I use date -s, which means someone changes the system's time. How I can write the rules?
Audit a command with a parameter under Linux
linux;audit