What syscall is used by rm? There is one for rmdir but I can't figure out how to audit when a file is deleted. Thanks, -Mont -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20060403/79a93f9f/attachment.htm>