Hi, Someone is trying to use the audit system's watch implementation. They have a requirement to watch any changes to /lib & /user/lib and lots of other files. At first they placed a watch on the directory thinking that it would get all changes. I pointed out that that catches meta-data updates and could miss some kinds of events on the files themselves. They created a shell script that places an audit rule for each file in the directory. At about 4500 files this quit working. The events aren't generated and auditctl -l stops listing rules. By their estimate, they need to watch approximately 90,000 files. 4500 falls far short of what's required. Anyone have ideas about how to handle this kind of situation? I think we need an elegant way to handle this. -Steve