auditctl -a always,exit -F arch=b64 -S execve -k process_exec
Audit every program execution
Logs each execve system call, meaning every command a process runs, tagged with process_exec. The arch=b64 filter covers 64-bit syscalls, and always,exit means always record on syscall exit. This produces many events, so pair it with ausearch for targeted queries.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.