On Monday, April 3, 2017 2:23:21 PM EDT warron.french wrote: The only change is systemd vs SysVinit initialization, augenrules being default rule loader, and updating rules for a change in where the default first user account starts (500 vs 1000). There are no changes in the audispd area. These have always been there. Note that all plugins default to off. I'd highly recommend moving to the 2.6.5 release. This is because the main feature of 2.6 was to resolve uid/gid during event processing so that reports run on aggregated logs resolve to the right account. The area between 0 and 300 are fixed accounts. All systems have the same account. The area between 300 and 1000 is also for system accounts but are not standardized. They are allocated randomly by the order of package installation. (This behavior is controlled by /etc/login.defs.) For example, the chrony daemon account on my main system is 990. On my latop, its 994. So, if my laptop sent logs to my main system, ausearch prior to 2.6 would do the lookup on the server and map account 994 to geoclue. After 2.6, auditd puts the mapping in the record after a special separator. Ausearch uses this during interpretation to display the correct account name. Besides that, there was a remote logging bug fixed on 2.6.1 that was causing remote logging problems in earlier releases. -Steve