Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Add more interpretations in auparse for syscall parameters - Add some interpretations to ausearch for syscall parameters - In ausearch/report and auparse, allocate extra space for node names - Update syscall tables for the 3.3.0 kernel - Update libev to 4.0.4 - Reduce the size of some applications - In auditctl, check usage against euid rather than uid As I mentioned in another email, one of the best features of this release is that for ausearch a little over 40 common syscalls can now have some of their arguments interpreted. This means that if you are doing an investigation and you needed to know what flags was being passed, it will now tell you. If the arguments to the syscall involve uid's or gid's, they are now resolves to the account name. Also in the interpreted mode, a 0x is prefixed to all syscall arguments that are not interpreted as a visual reminder that the numbers are in hex. This also contains an important bug fix where all records of a single event could not be grouped if the records contained a node name that was modest or large in size. All other changes in this release are self explanatory. Please let me know if you run across any problems with this release. -Steve