On Thursday, January 27, 2011 07:14:40 am Ashok Kumar J wrote: The short answer id that there is a rule matcher that checks the current syscall against the list of rules. http://lxr.linux.no/#linux+v2.6.37/kernel/auditfilter.c#L657 In reality, its a little more complicated because you have to get the flow of control to this function from syscall entry and exit. http://lxr.linux.no/#linux+v2.6.37/kernel/auditsc.c#L1562 http://lxr.linux.no/#linux+v2.6.37/kernel/auditsc.c#L1674 The event does not really get any substantial formatting because the audit daemon's job is to dequeue as fast as possible and get it to disk. Any display formatting can be done by search and reporting tools. But if you wanted to see it, this is the function that takes care of this for the RAW format specified in auditd.conf: https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L963 -Steve