Tracing web shell attack with Linux audit system : <p>I tried to trace web shell attack using Linux audit system.
Following is the rule I appended.</p>

<p><code>-a exit,always -F arch=b64 -F gid=nginx -S execve</code></p>

<p>(using nginx)</p>

<p>With this setting, I can trace commands not 'pwd', but 'ls', 'cat'.</p>

<p>What are differences those had? And how can I trace all commands thoroughly?</p>
