Linux Auditing patch and additional questions