If you are are an engineer whose organization uses Linux in production, I have two quick questions for you:
1) How many unique outbound TCP connections have your servers made in the past hour?
2) Which processes and users initiated each of those connections?
If you can answer both of these questions, fantastic! You can skip the rest of this blog post. If you can’t, boy-oh-boy do we have a treat for you! We call it go-audit.
Syscalls are how all software communicates with the Linux kernel. Syscalls are used for things like connecting network sockets, reading files, loading kernel modules, and spawning new processes (and much much much more).
Read more at Slack Engineering Blog
