Hello, On Wednesday, December 09, 2015 06:10:08 PM Santosh Ananthakrishnan wrote: Yes, this is intentional. Let's look at an event: type=DAEMON_START msg=audit(1450095206.768:6444): When str2event is entered, the pointer is at the '1'. The function calling it located the parenthesis. It also turns out to be the length of the decimal number for time. The reason that we can "safely" do this is because the audit project started in 2004. There would not be any kernel prior to that which has audit events created by the current audit system. If you get the time_t representation for August 2004, which is the time that the Linux audit mail list was started, you get: 1091332800. Any time after that would be bigger and longer. When time_t maxes out it'll look like: time_t: 0xFFFFFFFF, dec: 4294967295, date: Sun Feb 7 01:28:15 2106 Its still 10 digits long. So, the idea was to skip over the first 10 characters and start looking for the serial number closer to where its going to be in the buffer. I suppose a quick check could be done to make sure we don't have malformed records. Is that what you were wanting to see done? Thanks, -Steve