There appears to be some error handling deadcode in src/auditd-sendmail.c. If fd<0, then the function returns and the error handling code is never reached. This bug was found by Coverity, which I used to scan the audit code. Patch attached. :-Dustin --- audit-1.0.12/src/auditd-sendmail.c.orig 2005-11-08 15:34:49.931111016 -0600 +++ audit-1.0.12/src/auditd-sendmail.c 2005-11-08 15:35:28.340271936 -0600 @@ -45,15 +45,13 @@ int sendmail(const char *subject, const int fd; fd = safe_popen(&pid, mail_acct); - if (fd < 0) - return 1; - mail = fdopen(fd, "w"); if (fd < 0) { kill(pid, SIGKILL); close(fd); audit_msg(LOG_ERR, "Error - starting mail"); return 1; } + mail = fdopen(fd, "w"); fprintf(mail, "To: %s\n", mail_acct); fprintf(mail, "From: root\n");