On Monday 21 December 2009 10:46:51 am corbin(a)arlut.utexas.edu wrote: I really don't know what splunk is doing or why. Does it run with its own UID or does it run as root? If it does have its own uid, then that might be used for filtering. Aside from that, since its a commercial app, you might ask them if they've tested it on a linux system with nispom audit rules and what they would suggest. -Steve