On Tuesday, November 08, 2011 04:38:20 PM Eric Paris wrote: That was the plan. User space migrated to exit filter rules with the audit 2.0 release. That release was over 2 years ago. I also think the example rules in the 1.7 series was changed to the exit filter so that people don't start off with entry filter rules. So, you can start the process of deprecating it. I don't know if you want to just pull the filter out or warn for a while before pulling it out. -Steve