Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - In auditctl rules allow a0-a3 to be negative numbers - Add partial support for IMA integrity auditing - In s-c-audit, fix error handling with audit-1.7.12 and later - In s-c-audit, fix saving space_left_action - In s-c-audit, include many new translations - Aureport and ausearch do not need to stat the dispatcher - Make auparse handle empty AUSOURCE_FILE_ARRAY correctly (Miloslav Trmač) - Allow ausearch/report to specify multiple node names (Lenny Bruzenak) - Correct checking of != operator in audit_rule_fieldpair_data - Updated syscall table for 2.6.31 kernel - In auditd reset syslog warnings if disk space becomes available - Fix getloginuid for python bindings - In auditsp-remote plugin, timeout network reads (#514090) - Add audit.rules man page This release updates s-c-audit to the 0.4.10 release and pulls in various bug fixes from the trunk source code. Please let me know if you run across any problems with this release. -Steve