On Wednesday 10 August 2005 15:21, Linda Knippers wrote: > I'm running the sample CAPP rules with the .87 kernel and 1.0.1 > audit tools. I'm seeing duplicate watch/inode messages sometimes. Did this happen in previous kernels? .85 or .80 for example. -Steve