I am trying to pull the audit logs from a particular path but the Audit log is not capturing the entire command.

For Eg: If I give ls -l then it is capturing only ls but not -l.

So how can I capture the complete command “ls -l”?

@ug

Welcome, thanks for reading, and for the feedback.

@Bobin

Thanks for the useful additional thoughts expressed with practical experience from a system administration and security perspective.

This is very interesting topic, FYI according to security standard we need to define separate partition for audit logs under /var/log/audit/ using minimum size.

Thanks & Regards,
Babin Lonston