On Mon, 2005-06-20 at 11:09 -0400, Steve Grubb wrote: > There is something new that I noticed...all the SYSCALL messages have items=1. > It didn't used to be this way. It used to be the number of aux records > associated with the syscall event. It's always been the number of _names_ associated with the syscall, hasn't it? Try sys_rename(). -- dwmw2