Ok, I tore myself away from American Idol and spent some time on this. I can also confirm the problem Steve reported on a vanilla 2.6.10 kernel. I then added Chris's changes to the same kernel -- seems to work properly now -- I've already fixed the auditfs piece to use NETLINK_CB(skb).pid. That'll be in patch #5, update 2. -- Timothy R. Chavez