Firstly, on RHEL4 U5, I've noticed that if an argument has spaces in it, it won't be pretty printed in the EXECVE record. E.g.: # /bin/echo foo EXECVE... argv[1]="foo" # /bin/echo "foo bar" EXECVE... argv[1]=1234ABCD Is that a feature? Secondly, I noticed that the sequence of messages is: SYSCALL EXECVE CWD PATH I'm considering expanding argv[0] of EXECVE to be an absolute path. However, that would mean either buffering things or moving EXECVE after the PATH record. Would that break any contract, or reasonable expectations that anyone's aware of? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490