<html><body> <tt>When stopping and starting the audit daemon I noticed that the</tt> <tt>DAEMON_END audit record contains a subject field. However,</tt> <tt>ausearch does not find the record when you perform a search for the</tt> <tt>subject. Shouldn't ausearch be able to find the record if it</tt> <tt>contains a subject? The DAEMON_START audit record doesn't</tt> <tt>contain a subject and this seems a little bit inconsistent. Should</tt> <tt>it contain a subject value or does it and the DAEMON_END record</tt> <tt>really not require a subject (and thus ausearch not supporting</tt> <tt>searching that record by subject)?</tt> <tt>Thanks,</tt> <tt>Tom Lendacky (toml@us.ibm.com)</tt> </body></html>