Linux audit newbie question (Sorry probably a little boring...)