Isn't that just the return code of the syscall in question? Meaning, you'd need to look up the syscall in the relevant include file to see what -17 meant. Maybe auparse already does this, I'm not sure. <div class="gmail_quote">On May 1, 2013 12:10 PM, "Vaughn, Chad M" <<a href="mailto:chad.m.vaughn@lmco.com">chad.m.vaughn@lmco.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> All, Is there a listing somewhere that explains what various exit codes in auditd are? For example, we are getting some exit=-17 entries in our logs, and we have narrowed it down to an init script that tries to create a directory that already exists. So, we are pretty sure exit=-17 means that a directory already exits. It would be nice if we knew all codes and their translation, whether it be exit=-2, exit=-22, exit=-6, or exit=-17 and so on. I have yet to find that explained anywhere. Any info would be greatly appreciated and would help us fine tune our audit.rules file. Chad Vaughn -- Linux-audit mailing list <a href="mailto:Linux-audit@redhat.com">Linux-audit@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/linux-audit" target="_blank">https://www.redhat.com/mailman/listinfo/linux-audit</a> </blockquote></div>