Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide tomorrow. The Changelog is: - Add support for new file system auditing kernel subsystem This release adds initial support for the new file system auditing capability found in the lspp kernel. The -w/W switches still work for auditctl to maintain some backward compatibility. The -k and -p switches are deprecated since there isn't quite the same capability in the new system. The lspp.16 kernel can be found at http://people.redhat.com/sgrubb/files/lspp. Please let me know if there are any problems with this release. -Steve