On Tuesday 24 April 2007 12:28:29 Matthew Booth wrote: recv does not appear to be a x86_64 syscall. It uses recvfrom under the hood. Generally, all of them can be audited. I scan the headers for each kernel release and update the tables. For the time being, if you can see it in strace, you can use it. The only problems is that each arch is slightly different and then there is the multiplexed syscalls like socketcall & ipccall. -Steve