I was looking at Linux audit reports. Here is a log from ausearch.time->Mon Nov 23 12:30:30 2015  type=PROCTITLE msg=audit(1448281830.422:222556): proctitle=6D616E006175736561726368  type=SYSCALL msg=audit(1448281830.422:222556): arch=c000003e syscall=56 success=yes exit=844 a0=1200011 a1=0 a2=0 a3=7f34afa999d0 items=0 ppid=830 pid=838 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm=nroff exe=/usr/bin/bash subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)  From my understanding the comm argument is the name the user used to invoke the exe binary. How come is nroff referring to /usr/bin/bash? Note that this is a general question, I have seen this kind of thing, which I cannot explain, happen many times. In this particular case, here is more data about nroff and bash on my system.[root@localhost ~]# which nroff  /bin/nroff  [root@localhost ~]# ll -i /bin/nroff  656858 -rwxr-xr-x. 1 root root 3312 Jun 17 10:59 /bin/nroff  [root@localhost ~]# ll -i /usr/bin/bash  656465 -rwxr-xr-x. 1 root root 1071992 Aug 18 13:37 /usr/bin/bash  
auditctl comm vs. exe
command;executable;audit;linux audit
The nroff executable provided by groff is a shell script, e.g.,#! /bin/sh# Emulate nroff with groff.## Copyright (C) 1992, 1993, 1994, 1999, 2000, 2001, 2002, 2003,#               2004, 2005, 2007, 2009#   Free Software Foundation, Inc.## Written by James Clark, maintained by Werner Lemberg.# This file is of `groff'.Depending on the system you are using, /bin/sh may be a symbolic link to /usr/bin/bash, e.g., Fedora, which links /bin to /usr/bin.