Hi, I was wondering if we need to capture all audit messages during bootup to the audit system. The reason I ask is that there are AVC messages that can occur before the audit daemon is running. Or do we only care about the audit messages that occur once the system is to a point where someone could attempt login? Thanks, -Steve