----
time->Sat Aug 108:25:51 2020type=PROCTITLE msg=audit(1596288351.207:72): proctitle=746F756368002F657463
2F7265736F6C762E636F6E66
type=PATH msg=audit(1596288351.207:72): item=1name="/etc/resolv.conf" inod
e=914843dev=08:12 mode=0100644ouid=0ogid=0rdev=00:00 nametype=NORMAL ca
p_fp=0000000000000000cap_fi=0000000000000000cap_fe=0cap_fver=0type=PATH msg=audit(1596288351.207:72): item=0name="/etc/"inode=913921 de
v=08:12 mode=040755ouid=0ogid=0rdev=00:00 nametype=PARENT cap_fp=0000000000000000cap_fi=0000000000000000cap_fe=0cap_fver=0type=CWD msg=audit(1596288351.207:72): cwd="/root"type=SYSCALL msg=audit(1596288351.207:72): arch=c000003e syscall=257 succes
s=yes exit=3a0=ffffff9c a1=7ffe5d513992 a2=941a3=1b6 items=2ppid=10519 p
id=14052auid=1000uid=0gid=0euid=0suid=0fsuid=0egid=0sgid=0fsgid=0tty=pts0 ses=18171comm="touch"exe="/usr/bin/touch"subj==unconfined key=(null)
Once you've confirmed that the monitoring is working, all you have to do is wait
and check with sudo ausearch -f /etc/resolv.conf every now and then until you
finally get a result.
Once you've got the information you need, you can remove the monitoring
with sudo auditctl -D. Note: this removes all monitors you've configured.