A symlink vanishes and the normal logs say nothing. syslog and the journal record what programs choose to say. auditd records what the kernel actually did in the syscall path. That is why it names the culprit, and why it only works if you turned it on first.
tag: #auditd
1 posts