Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide tomorrow. The Changelog is: - Remove /lib/libaudit.so & .la from audit-libs package - In auditctl, if syscall not given, default to all This release sets the syscalls to "all" when none is specified so that rules for the watch and user list have a chance to work. Please let me know if there are any problems. -Steve