<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> </head> <body text="#000000" bgcolor="#ffffff"> Hi, I did some research and am confused about starting the audit daemon at boot time, so that you don't get auid's of 4294967295. In RHEL 5.5, my grub.conf looks like this: <blockquote>audit=1 # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE: You have a /boot partition. This means that # all kernel and initrd paths are relative to /boot/, eg. # root (hd0,0) # kernel /vmlinuz-version ro root=/dev/sda4 # initrd /initrd-version.img #boot=/dev/sda default=0 timeout=5 splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu title Red Hat Enterprise Linux Server (2.6.18-194.el5) root (hd0,0) kernel /vmlinuz-2.6.18-194.el5 ro root=LABEL=/ rhgb quiet initrd /initrd-2.6.18-194.el5.img </blockquote> audit=1 is the first line, so why am I still getting the 4294967295 auid's? Thanks </body> </html>