Actually, this statement was amended in a later Industrial Security Letter... The comments from the ISL have been incorporated into our NISPOM docs and include the following: 8.602. Audit Capability (c) Successful and unsuccessful accesses to security-relevant objects and directories, including creation, open, close, modification, and deletion. 55. Question: Paragraph 8-602a(1)(c) can generate upwards to 100 audit entries for each successful access to security-relevant objects and/or directories. From a security standpoint, is this information of enough importance to generate voluminous amounts of auditing data? Answer: No. Only unsuccessful accesses need to be audited. Now I can easily imagine that Sarbanes-Oxley or HIPPA may require auditing successful accesses to SROs, but the NISPOM no longer requires it... -Randy Zagar linux-audit-request(a)redhat.com wrote: -- Randy Zagar Sr. Unix Systems Administrator E-mail: zagar(a)arlut.utexas.edu Applied Research Laboratories Phone: 512 835-3131 Univ. of Texas at Austin