[ since steve mentioned his email was not working... ] Hello, Steve just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit Presumably, it will also be in rawhide tomorrow. The Changelog is: - Add check for fields that cannot be used with syscall entry in auditctl - Make auditctl not tolerate duplicate rule and watches - Remove uid check in ausearch Please report any problems. rob.