I actually figured it out yesterday. I just need to add name=value pairs as text in the user msg to be interpreted by Audit Viewer. Thanks for the quick response. ________________________________ From: Miloslav Trmac [mitr(a)redhat.com] Sent: Tuesday, February 26, 2013 2:29 AM To: Brown, Curtis (cbrown31) Cc: linux-audit(a)redhat.com Subject: Re: User msg in Audit Viewer Hello, can you please attach a sample (possibly one-line) log file? Thank you, Mirek ________________________________ I don’t know if this the correct forum for questions about the Audit Viewer but here goes. I wrote a test app to write an audit user message (audit_log_user_message). This is successful. I’m trying to display the msg=”” portion of the audit record in Audit Viewer without success. The msg portion doesn’t show up in the “Other Fields” displayed by Audit Viewer but is present in the actual audit record. Any help would be appreciated or please point me to a forum that can answer my question. -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit