Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Correct the header length for dispatched events - Revise buffer handling in auditd to fix dispatched events - Fix spelling in man pages - Add documentation link to systemd unit file - Correct af_unix pathname detection in ausearch/report - Add remote_ended info to audisp-remote stat dump This release fixes truncated records passed to audisp plugins when the old event format was used. It was also discovered that ausearch was not picking up patchnames for af_unix sockets and this was corrected. Besides that there were several documentation fixups. Please let me know if you run across any problems with this release. -Steve