syscall names are architecture independent

On RHEL 4 U5 x86_64, if you have the following rule: -a entry,always -S removexattr you'd expect the result to be that the removexattr call is audited. This isn't quite the case. What this actually means is 'audit system call 197'. The effect of this is to audit 64 bit removexattr calls and 32 bit fstat64 calls. I can see why this is the case, however this is clearly both undesirable and far from intuitive. I'm not entirely sure what the solution should be, but a big warning in the man page might be a good start :) As a general rule, this highlights that it's always essential to additionally filter by architecture on x86_64. Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490