While playing around with a test case for ausearch, I found the man page could have been more helpful. The message types obviously need to be updated. But in addition to that, it's not at all clear what options can be combined. Not all options will apply to all message types. For the purposes of an evaluation, the man page is the functional specification. It needs to be unambiguous. -- Thanks, Dan Jones IBM Linux Technology Center, Security 512-838-1794 (T/L 678-1794) hotrats(a)us.ibm.com