I see now that Steve has responded as well, But I was in the middle of drafting a response, so some of this may have already been covered. On 11/3/05, Amy Griffis <amy.griffis(a)hp.com&gt; wrote: Agreed. That's easy enough to do, even if the underlying implementation is actually the rules functionality. I agree with aliasing. I think we should make it as easy as possible on the user. But there's no reason to cripple the user's ability to specify the numbers as well. There are several other places in the auditctl code that accepts numbers or strings (user/uid, group/gid), so I think we should continue to provide this flexibility in these cases as well. I say that we just drop the AUDIT_ from any message types and use that. The AUDIT_ is understood. I agree that it 'should' suffice to most users, but the audit_operators code is already there for our use and it really provides infinite flexibility and range specification beyond what few use cases you and I can foresee today. It doesn't cost us anything extra to give >,<,>=,<= so I think we should give the admin as much flexibility as possible. Again, it doesn't cost us anything to offer this as a possibility. In fact, it would take more code to forbid users from excluding a single message type. :-Dustin