[MrSec]

Look into auditd for logging execve() syscall instead. OSSEC can (directly) report or act on any thing reported through logs.

[rmdoss]

And send it to Slack now as well:

https://blog.sucuri.net/2016/01/server-security-integrating-...