event loss with dispatcher?

Hi, I'm trying to debug a potential problem with the dispatcher mechanism in version 1.6.2. Long story short, I saw that some records were being missed in the remote system (using the audisp-racf plugin), couldn't find anything wrong with the code, so I enabled the syslog plugin, trying to match the the syslog with the audit log output - At least in my system, they are not matching. In cases where there are more than one record per event, (eg. SYSCALL, CWD, PATH), the majority of times only the syscall record is sent to the syslog.. in rare cases I could see the path or the cwd record as well. The impression that this would be a timing issue increased when I tried to debug the daemon itself, placing a breakpoint in the distribute_event() and/or dispatch_event() functions - in that case, I could see all records going through, both in the execution path as in the syslog. Later also placed some debugging hooks in the process_inbound_event() in the dispatcher code, and saw that records were already missing at that point. The lossy/lossless setting for the dispatcher queue doesn't appear to affect this behavior. My tests involves a filesystem watch - when triggered, only 3 records are generated (so not anywhere near the 128K buffer size) My env: RHEL 5 GA on s390x (sorry - no other box available for testing at this time) with audit 1.6.2 (built from src.rpm as downloaded from Steve's website). Steve, btw, can you hold the audisp-racf merge a little bit? Found some issues with selinux policy, the mapping to the remote system and believe it or not, the plugin name itself :( Thanks, -Klaus Kiwi