Hi<br><br>I need to audit some specific commands which have the following form<br><br>cmd -arg1 -arg2 -query &#39;some query(&quot;args&quot;)&#39;<br><br>In audit log I get a record like:<br>type=EXECVE msg=audit(1282117611.037:27469599): argv<span class="error">[0]</span>=&quot;cmd&quot; argv<span class="error">[1]</span>=&quot;-arg1&quot; argv<span class="error">[2]</span>=&quot;-arg2&quot; argv<span class="error">[3]</span>=&quot;-query&quot; argv<span class="error">[4]</span>=737472626567696E73287468726561645F69642C227468726561645F69643D32333639383932662229 <br>
<br>Now, I&#39;d really need to get the last query argument in an understandable form. Is this possible or is this the way it is and I can&#39;t do it?<br><br>Thanks<br><br>Jure<br>