Problem Sending Watch List

I know I've found something about this issue before, but for the life of me I can't find it now. I'm trying to set a watch list on a modified RHEL 4.2 system and I get the error messge: Error sending watch list request (Operation not supported) I know this works on later versions of RHEL 4.x, but I don't remember which component has the fix (kernel, audit, what?). Sorry to ask about this but searching the mailing list archive and the 'net hasn't lead me to the answer. Thanks, --Tad