Hi Burn, It was suggested I specifically bring your attention to this request since you had instigated the feature. Would it be possible to have an empty checkpoint file created when the search failed so that there was a mark in time to continue the search later? https://github.com/linux-audit/audit-userspace/issues/32 "ausearch --checkpoint should create empty checkpoint file with date/time stamp when no events found" - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635