Hello, I was testing the kernel and found a problem where the credentials are not being recorded for LOGIN messages. Here's a typical message: type=LOGIN msg=audit(1114444861.363:0): login pid=0 uid=0 old loginuid=4294967295 new loginuid=0 The pid cannot be 0. The problem is that the kernel code assumes the information is in the audit context. What if audit_get_context has never been called for that process? Attached is a patch that passes the needed info out of the task struct to the function that emits the message. -Steve