aurun – run an application with auditing enabled
Aurun runs a command with system call auditing enabled. You need to
have sufficient privilege in order to invoke aurun.
auditd – collect system call audit records and write them to file
Auditd collects audit records generated by the kernel system call audit
mechanism, and writes them to disk.