Hello steve, Use option "-a" cannot report about avc messages, when message type is USER_AVC. # echo "type=USER_AVC msg=audit(1221967380.698:35458): user pid=8185 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: received policyload notice (seqno=6) : exe=\"?\" (sauid=81, hostname=?, addr=?, terminal=?)'" | aureport -a AVC Report ======================================================== # date time comm subj syscall class permission obj event ======================================================== <no events of interest were found> Signed-off-by: Peng Haitao <penght(a)cn.fujitsu.com&gt; --- src/aureport-scan.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/aureport-scan.c b/src/aureport-scan.c index f42cf12..9374a02 100644 --- a/src/aureport-scan.c +++ b/src/aureport-scan.c @@ -449,6 +449,9 @@ static int per_event_detailed(llist *l) if (list_find_msg(l, AUDIT_AVC)) { print_per_event_item(l); rc = 1; + } else if (list_find_msg(l, AUDIT_USER_AVC)) { + print_per_event_item(l); + rc = 1; } break; case RPT_MAC: -- 1.5.3 -- Regards Peng Haitao