threat-intel
Linux Kernel Process Accounting, (Wed, Aug 12th)
Medium
Summary
This article details the Linux kernel process accounting feature, a tool for logging process activity on Linux systems. It’s a relatively simple-to-implement feature that doesn’t require kernel recompilation and can be used to track process behavior. While it doesn’t capture command-line arguments, it provides valuable insights beyond bash history and can be integrated with log management systems like syslog-ng. The article highlights its usefulness for security investigations and centralized logging, particularly within containerized environments.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data