On Saturday 12 January 2008 08:45:09 Abhishek Gupta wrote: seconds.msec:serial number The seconds can be converted with ctime(). This is not a message type, its just the unique time stamp for the event. You would use the autrace program. After running it, it will tell you what ausearch command to run to see the results. The output will not be formatted like strace, but it contains the information. If you are writing a program that analyzes the audit data, I'd recommend using the auparse library to do all your parsing and data interpretation. -Steve