You might see this note twice, I sent it through my new account (in Text), but the new account is waiting approval by the moderator still, so it might pop on the mailing list once approved (Small addition to this note, labeled NEW) I just updated to kernel.28, and latest audit-0.7.3 Now, I am unable to create any watches. Here is what I get: [root@comp1 objident]# auditctl -w /tmp/file1 Error sending watch insert request (Invalid argument) Error sending rule to kernel NEW: [root@comp1 objident]# auditctl -w /tmp/delete_logs (file already exists) Error sending watch insert request (Cannot allocate memory) Error sending rule to kernel Using the kernel.20 and audit-0.7.3, I get: [root@comp1 objident]# auditctl -w /tmp/temp_file Error sending watch insert request(Bad address) Error sending rule to kernel using kernel.20 and audit-0.7.2: Works fine Has anybody else seen this yet? - loulwa