Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit It will also be in rawhide tomorrow. The Changelog is: - updated audit_rule_fieldpair_data to handle perm correctly (#226780) - Finished search options for audit parsing library - Fix ausearch -se to work correctly - Fix auditd init script for /usr on netdev (#228528) - Parse avc seperms better when there are more than one This adds the code behind the search API of the audit parsing library. The regex code is not done at this point. The other known problem with the API right now is that it does not account for out of order records. Please let me know if there are any problems with this release. -Steve