Krzysztof Mazurczyk said: > Hi all, > > Is there a tool which allows to look what a process has tried to do? > strace can look at a running process, but to see what a process did in the past, I think you'd need some kind of advanced kernel auditing stuff(I believe it's available out there, its not common though) and of course you'd only be able to audit stuff that ran while the special software was loaded in the kernel. nate