On Tue, 2005-08-23 at 23:48 -0500, Debora Velarde wrote: > For auditctl, what are acceptable values for the -F success flag? > 0, 1, yes, no? They all have the same effect -- the parameter is ignored. The 'success' filter matches when the system call was successful. I thought there was a 'failure' filter too, but that doesn't appear to be the case. -- dwmw2