I am sure I am missing something obvious but I need help figuring out how to use the streaming output mode listed in audit.conf to stream audit info to syslog. The config file has: output { mode = stream; command = "/usr/local/sbin/send_to_syslog"; }; Using /usr/bin/logger does not work - I saw a reference to using popen() but nothing else. Any ideas? Thanks I really appreciate any help. Thanks Ed ------------------------ CONFIDENTIALITY NOTICE This e-mail and any attachments contain information which may be confidential or privileged and exempt from disclosure under applicable law. If you are not the intended recipient, be aware that any disclosure, copying, distribution, or use of the contents of this information is without authorization and is prohibited. If you have received this email in error, please immediately notify us by returning it to the sender and delete this copy from your computer system. Thank you. ------------------------