On Tuesday, October 29, 2013 03:39:35 PM leam hall wrote: auid is also known as the loginuid. its the account that you enter the system with. Since root is a shared accound amongst admins, you should also forbid logging in under root. The auid should never change during the life of your session. Which brings up another point. At login, you also get a session id (ses) which is also inherited by all processes in your session. This allows the audit system to disambiguate the actions of two simultaneous logins to the same account. -Steve