

Thanks, I’ll try and see how it works.
Ok, so I did a thing with git and checked the audit log with ausearch -k test-key.
Then I got the ppid (say 2000) and then ran ausearch --pid 2000, which gave no output, while doing ausearch --pid 2000 just gave the same entries that I got from the previous one.
So, unable to get the process tree that way.
Perhaps there is some setting I am overlooking?
















It’s 3.
One inside.