On Tuesday 06 June 2006 09:29, Evren Kalayciklioglu wrote: I'd be curious to see the patch when you have one. I think its possible to update the code to do this. My personal setup is simply ASCII. That's all it has been tested for. First I'd see if you can insert a watch and list a watch so that it looks right. When that is working, then check the audit logs with vi/emacs/less to see what kind of records you get. You may find the filenames are encoded. If so don't worry about it. Next check the output of ausearch. Something like 'ausearch -m PATH' should be good enough. Correct that code to display the characters. Next try to find a file, 'ausearch -f some-name'. After that is working, try executable, 'ausearch -x some-name'. Next get command names working, 'ausearch -c some-name'. If you allow host names in turkish try 'ausearch -h some-name'. You may also archive audit logs with turkish characters so you will want to try copying the audit logs to a file with turkish name and run 'ausearch -if some-name'. Any changes from the above should be checked to see if they apply to aureport. Then I'd start working on that program. As I said, I'd be interested in seeing the patches. -Steve