On Tuesday 24 April 2007 17:58:10 Machin, Glenn D wrote: That config option is only valid in RHEL4U2 and higher kernels within the RHEL4 series. That filesystem auditing attempt was rejected when it was presented upstream on the basis of too much overlap with inotify. (6 months prior we were told not to use inotify because we'd hurt its chances of getting upstream.) So, it was refactored and merged with the mainline kernel as of 2.6.19. (RHEL5 has all the right patches.) In the latest upstream kernels, you do not need to use CONFIG_AUDITFILESYSTEM. It was decided that people might forget to enable that option and only have half the functionality. So, if you specify CONFIG_AUDITSYSCALL in current kernels, you get the whole thing. The one that's in RHEL4 is. Well, CentOS, too. But I've preserved the user space commandline interface so that rules written for RHEL4 work just as well with any 2.6.19 or later kernel. -Steve