have event be I believe this should be covered by the existing syscall auditing such as open and others. The LSPP doesn't state the auditing of the export has to be any different than other fs auditing, just that it has to occur IMHO. The additional requirement is the device allocation auditing requirements. An audit analyst should *hopefully* be able to correlate what has been exported given these events. -Chad