On Thursday, November 21, 2013 10:20:28 AM Aaron Lewis wrote: The two don't mix. RHEL4's filesystem watch technique was rejected by the upstream kernel community, so its unique. The 2.6.16 and higher kernels use the current technique. The audit 1.0.x series is designed for the old technique, while audit 1.1 and higher use the new technique. You also cannot upgrade from audit-1.0.x without rebuilding a fair amount of user space. IOW, what you are doing was really never meant to work. You have 2 choices, push forward with rebuilding user space with new audit package or go back to old kernel if you need auditing. If you choose to use a new audit package, also be aware that generally audit stays in sync with the kernel. So, if you use a very new audit package and very old kernel, you might have other features that don't work properly. -Steve