So this is just a fix to the already patched kernel. I'll come up with a new patch against the entire RH 2.6.9 tree momentarily. When patching by hand I forgot to include the function that initializes the auditfs caches. --- audit.c~orig 2005-04-20 14:52:30.000000000 +0000 +++ audit.c 2005-04-20 14:52:16.000000000 +0000 @@ -574,6 +574,7 @@ int __init audit_init(void) audit_initialized = 1; audit_enabled = audit_default; + audit_filesystem_init(); audit_log(NULL, "initialized"); return 0; } -tim