On Thursday 23 March 2006 09:48, Taylor_Tad(a)emc.com wrote: They would simply use one of these functions: /* The following are for standard formatting of messages */ extern int audit_log_user_message(int audit_fd, int type, const char *message, const char *hostname, const char *addr, const char *tty, int result); extern int audit_log_user_comm_message(int audit_fd, int type, const char *message, const char *comm, const char *hostname, const char *addr, const char *tty, int result); extern int audit_log_acct_message(int audit_fd, int type, const char *pgname, const char *op, const char *name, unsigned int id, const char *host, const char *addr, const char *tty, int result); extern int audit_log_user_avc_message(int audit_fd, int type, const char *message, const char *hostname, const char *addr, const char *tty, uid_t uid); The top one would be the most likely choice. It does. :) A good, simple example is util-linux login & hwclock programs or passwd. The one thing to note is that you need to have CAP_AUDIT_WRITE in order to be successful. -Steve