Search Results

Tracing execs and examining arg lists will not capture interactive file editing. For example:
vi unaudited_file
:e audited_file
Tracing file accesses (as Peasant suggested in post#2 in this...

Yes it should.

Take a look at this :
Fork-exec - Wikipedia, the free encyclopedia (http://en.wikipedia.org/wiki/Fork-exec)

Best way is to test it to make sure.

Regards
Peasant.