On Tue, 2005-01-04 at 16:20, Chad Hanson wrote: First and foremost, just separating the SELinux audit messages from other kernel log messages, i.e. don't send them to syslogd and don't put them in /var/log/messages. Then, if desired, separate them from DAC audit messages. That will require a callback by the kernel audit framework into the security module to get the supplementary information (e.g. the security contexts) for inclusion in the DAC audit record, as the kernel audit framework has no direct knowledge of security contexts. -- Stephen Smalley <sds(a)epoch.ncsc.mil&gt; National Security Agency