If I do a "service auditd rotate" it just sends the auditd the USR1 signal which means "start the rotation". On a slow/burdened machine with many files this is not immediate. I am trying to run a cron job which will : mkdir /var/log/audit-archive/ service auditd rotate mv /var/log/audit/audit.log.* /var/log/audit-archive/ But the files listed are not through rotating so it has issues (file not found, leaves behind the last one rotated - audit.log.1, etc.). How can I tell when the rotate is complete so I can move the files out? I'm sure there is a simple way but I cannot see it. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com