Hm, Could it be to minimize risk of filling up the buffer and to also a produce seperation of records? This way userspace auditd can stitch together a log record per name, based on the serial numbers? A one-to-many relationship so-to-speak. This way you get one record containing all the common information and X records containing all the unique information instead of one super huge record that's immensely difficult to parse or X records with a bunch of redundant information in them. -Tim On Wed, 5 Jan 2005 08:27:55 -0500, Steve Grubb <sgrubb(a)redhat.com&gt; wrote: -- - Timothy R. Chavez