I was recently going through syscalls I'm auditing and matching them up to symbols in System.map starting with 'sys_'. I noted that the two don't appear to be completely related. The system in question is RHEL 4 x86_64. Specifically I noted: * sys_stime is in System.map, but 'stime' is not recognised by auditctl * sys_umount2 is not in System.map, but is recognised by auditctl Am I looking for a relationship which doesn't exist? Is there a better way to get a definitive, locally generated list of all auditable syscalls on a particular machine? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490