We're looking for a tool that does the same thing as Windows Sysmon (Sysinternals), but for Linux. The problem with ps and other process monitoring inputs in the Linux TA is the interval. If a process launches and closely quickly, an interval capture will missed it. We need something that will write a log whenever a process is created, preferably with the command launching the process.
Any input is appreciated.
↧