steve- the attached patch also prevents ausearch from checking for group write permissions on audit.log, which i missed in what i pasted earlier on irc. this patch will be an improvement for me because i create an audit group that i want to be able to review the logs, but not to modify them. unless this has unintended consequences, or breaks things for someone else please apply. thanks. rob.