I have a question about the SOCKADDR token in a SYSCALL record (syscall 42 -- connect()) Most of my records begin with one of the two values: saddr=0200 saddr=0100 Followed by the port & IPv4 address or the file path. QUESTION 1: The file path appears to be NULL terminated. Is this correct? QUESTION 2: There is often additional characters after the 00 termination (and IP address). Is this just garbage that should be ignored? QUESTION 3: Sometimes the first byte in a file path is 00 termination (e.g., saddr=0100002F…). Does this mean the string is empty and the content following it is garbage? Or is there a bug that accidentally prepends the 00 to the front of the saddr sequence? Here is an example: ———————— type=SYSCALL msg=audit(1397089029.264:7407): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=7fff3a7fdf70 a2=16 a3=7fff3a7fdd20 items=0 ppid=805 pid=1064 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="initctl" exe="/sbin/initctl" key=(null) type=SOCKADDR msg=audit(1397089029.264:7407): saddr=0100002F636F6D2F7562756E74752F75707374617274 ———————— If I assume the first 00 is a bug, the string decodes to /com/ubuntu/upstart Thanks, Todd PS. uname -r gives 3.13.0-24-generic (though, I think I collected these logs before the last software update)