>>I'm running the sample CAPP rules with the .87 kernel and 1.0.1 >>audit tools. I'm seeing duplicate watch/inode messages sometimes. > > Did this happen in previous kernels? .85 or .80 for example. I just tried .77 and .81 (what I had handy on my system) and it does the same on both of those. -- ljk