On Thursday 26 May 2005 15:46, Timothy R. Chavez wrote: > Is the inode being reported the inode of audit/ or audit.log? logs have long since been rotated. I'll try to recreate in better way. Also, I've been torturing my machine with rule & watch insertion for over an hour. It seems to be doing fine. Maybe the undersized allocation was causing all my problems. -Steve