Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Make alpha processor support optional - Add support for the arm eabi processor - add a compatible regexp processing capability to auparse (Miloslav Trmač) - Fix regression in parsing user space originating records in aureport - Add tcp_max_per_addr option in auditd.conf to limit concurrent connections - Rearrange shutdown of auditd to allow DAEMON_END event more time This release drops support for the alpha processor unless you re-add "--with- alpha" to the ./configure line. This release also adds support for the arm eabi processor when you add "--with-armeb" to the ./configure line. Please note that the 2.6.32 kernel does not actually work for auditing on ARM systems. Hopefully someone will write the 4-5 lines of code to make it work. A new regexp processing capability was added to libauparse. And there were several bug fixes. The first was that I noticed on 2.0.x systems that use of authentication mechanisms was not showing up in aureport even though they were in the logs. The problem was traced to not applying a patch that corrected parsing with the slight format change in the 2.0.x series. A new config option was added to auditd.conf to set the maximum number of concurrent system connections. The default is 1 which should work for most installations. And lastly, the shutdown sequence was altered slightly to give remote logged audit events a little more time to get sent before the audit daemon starts terminating child processes. Please let me know if you run across any problems with this release. -Steve