Hello, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide tomorrow. The Changelog is: - Make sure error packets get eaten. - Fix a few error messages in auditctl - Fix handling of unsupported watches when reading rules from file in auditctl This is a bugfix release that addresses problems when people build their own kernels and do not have everything enabled as a distribution kernel would be. This package is not going to be built for RHEL4 at this time. Let me know if there are any problems. -Steve