<tt>k1rkland@us.ltcfwd.linux.ibm.com wrote on 02/14/2006 01:14:46 PM: > On Tue, 2006-02-14 at 13:17 -0500, Linda Knippers wrote: > > It seems to work with a rule like this: > > /sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9 > > Should we in userspace then translate something like > /sbin/auditctl -a exit,always -S pread64 -F exit=-9 > to > /sbin/auditctl -a exit,always -S pread64 -F success=no -F exit=9</tt> <tt>I would say yes, seeing as that is an audit-ism that people shouldn't be forced to deal with. (And it should be a simple patch to get that to work).</tt> <tt> Mike</tt>