Here is a silly question ( I don't know if this has been resolved in newer releases, I am using audit-1.7.13). I have an execve rule for any attempt to execute auditd for example. I never get any audit records when mortal users attempt to run the command (even though they will fail). I only see success events when the commands are executed as root. I know all of the executables that ship with the audit packages check to see if root is executing them, but I think there is value in knowing who might be attempting to stop the audit daemon from a security perspective. Anyone have any thoughts on this? Thanks, Kevin