<html><body> <tt>Since we will soon be able to filter USER messages by auid, I have a question about what the default behavior will be.</tt> <tt>Currently, all USER messages are captured by default, will this remain true? Or will there be a new auditctl rule to</tt> <tt>turn on or off auditing of USER messages, similar to how we have "-S all" for syscalls?</tt> <tt>Once we are able to audit by auid, will we then audit all USER messages unless the auid of the </tt> <tt>USER message matches a filter rule such as "auditctl -a exit,always -F auid!=<auid>"?</tt> <tt>Thanks,</tt> <tt>debbie</tt> </body></html>