Hi, Attached is simple fix for auditd that it assumed incoming msg is c string(null terminated) but they are not sometimes. I briefly looked into kernel audit code, it looks like it is sending out exact length of string, no '\0' at the end of message string so auditd's log sometimes corrupted. It's a small patch from my plugin support auditd. -- Junji Kaneamru Linuon Inc. Tokyo Japan