<html><body> <tt> > > auditctl -a user,never -F loginuid!=$LOGINUID > > auditctl -a user,always -F loginuid=$LOGINUID > > With audit 0.9.11 and kernel.audit.64 on a pSeries system, it just prints out the usage info (no other info about what it doesn't like) if I try running any of the following commands:</tt> <tt>auditctl -a user,never -F loginuid=500</tt> <tt>auditctl -a user,never -F auid=500</tt> <tt>auditctl -a user,always -F loginuid=500</tt> <tt>auditctl -a user,always -F auid=500</tt> </body></html>