On Tuesday 29 March 2005 10:43 am, Stephen Smalley wrote: > I see an audit message for syscall 38 (rename), with two auxiliary items > for shadow (with garbage for the inode= fields, looks like you aren't > setting the ino field upon audit_notify_watch) Hahaha... oops :) Fixed. -- -tim