What might cause this? At some point my event IDs got reset (they didn't cycle that fast!). I've been playing quite a bit with the audit system so I'm not sure what caused it. Possibilities include: - Restarting the auditd service - Rebooting the machine - Deleting the /var/log/audit/audit.log file Or should this just plain not happen? I'm on FC4 using kernel 2.6.12-1.1447_FC4xen0. I'm afraid I can't easily upgrade at the moment because I've build an entire system predicated on old versions of SELinux and Xen. I also have a couple of other questions: - How large to audit event numbers get before they cycle back to zero? - Is there any way to have ausearch only the most recent audit log instead of all logs? [root@localhost audit]# ausearch -a 8412 ---- time->Wed Apr 5 14:57:12 2006 type=PATH msg=audit(1144263432.028:8412): item=0 name="/home/dev/.icons/crystalsvg/index.theme" flags=101 inode=1278228 dev=03:01 mode=040775 ouid=600 ogid=600 rdev=00:00 type=CWD msg=audit(1144263432.028:8412): cwd="/home/dev" type=SYSCALL msg=audit(1144263432.028:8412): arch=40000003 syscall=5 success=no exit=-2 a0=832d8e8 a1=0 a2=1b6 a3=83630e8 items=1 pid=1226 auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600 sgid=600 fsgid=600 comm="metacity" exe="/usr/bin/metacity" ---- time->Wed Apr 5 15:30:44 2006 type=PATH msg=audit(1144265444.562:8412): item=0 name="/home/dev/.Xauthority-c" flags=310 inode=1278085 dev=03:01 mode=040775 ouid=600 ogid=600 rdev=00:00 type=CWD msg=audit(1144265444.562:8412): cwd="/home/dev" type=SYSCALL msg=audit(1144265444.562:8412): arch=40000003 syscall=5 success=yes exit=2 a0=bfae17d3 a1=c1 a2=180 a3=bfae1f10 items=1 pid=1573 auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600 sgid=600 fsgid=600 comm="xauth" exe="/usr/X11R6/bin/xauth" Thanks, Steve Brueckner, ATC-NY