On Wednesday 27 September 2006 16:57, Azrael wrote: Not sure if there is much docs publicly available. Not because we don't want it, but very little developer time. There's not really a protocol per-se, you send a command and expect a response. But you always get something back. The commands are in linux/audit.h header file. Aside from that, you'd probably just want to look at libaudit source code. Not really. auditctl.c + libaudit pretty much shows it. That would be nice. We would like some docs available, but are short for time. -Steve