Hi, I've just released a new version of the audit daemon. It can be downloaded from http://people.redhat.com/sgrubb/audit. It will also be in rawhide soon. The ChangeLog is: - Make auparse handle empty AUSOURCE_FILE_ARRAY correctly (Miloslav Trmač) - On i386, audit rules do not work on inode's with a large number (#554553) - Fix displaying of inode values to be unsigned integers when listing rules - Correct Makefile install of audispd (Jason Tang) - Syscall table updates for 2.6.34 kernel - Add definitions for service start and stop - Fix handling of ignore errors in auditctl - Fix gssapi support to build with new linker options - Add virtualization event types - Update aureport program help and man pages to show all options A few bug fixes and cleanups. This release also introduces a couple new event types to be used with service start/stop and virtualization. Please let me know if you run across any problems with this release. -Steve