> There is an AUDIT_LOGIN msg. Is that what you want to use? No, in fact my patch got rid of that. That message just set the loginuid, which is what we now want to do via /proc. -serge