I seem to be building them faster than I can announce them. When testing socketcall code I observed that auditd was logging its own actions, which soon descended into insanity as it generated two more log entries for every one that it read from the socket. I have added code to auditsc.c to exempt the audit_pid from being audited -- see attached patch. The rest of it is just getting the skb queueing via kernel dæmon working properly... * Thu May 19 2005 David Woodhouse <dwmw2(a)redhat.com&gt; audit.44 - Honour audit_backlog_limit again - Reorder patches to reflect upstream status * Thu May 19 2005 David Woodhouse <dwmw2(a)redhat.com&gt; audit.43 - printk in audit_log_end() when no auditd - Don't audit auditd itself * Wed May 18 2005 David Woodhouse <dwmw2(a)redhat.com&gt; audit.42 - Restore Chris' third audit-to-skb patch -- dwmw2