Duplicate audit event IDs

[Steve Brueckner]

What might cause this?  At some point my event IDs got reset (they didn't
cycle that fast!).  I've been playing quite a bit with the audit system so
I'm not sure what caused it.  Possibilities include:

 - Restarting the auditd service
 - Rebooting the machine
 - Deleting the /var/log/audit/audit.log file

Or should this just plain not happen?  I'm on FC4 using kernel
2.6.12-1.1447_FC4xen0.  I'm afraid I can't easily upgrade at the moment
because I've build an entire system predicated on old versions of SELinux
and Xen.  

I also have a couple of other questions:

 - How large to audit event numbers get before they cycle back to zero?
 - Is there any way to have ausearch only the most recent audit log instead
of all logs?

[root at localhost audit]# ausearch -a 8412 
----
time->Wed Apr  5 14:57:12 2006
type=PATH msg=audit(1144263432.028:8412): item=0
name="/home/dev/.icons/crystalsvg/index.theme" flags=101  inode=1278228
dev=03:01 mode=040775 ouid=600 ogid=600 rdev=00:00
type=CWD msg=audit(1144263432.028:8412):  cwd="/home/dev"
type=SYSCALL msg=audit(1144263432.028:8412): arch=40000003 syscall=5
success=no exit=-2 a0=832d8e8 a1=0 a2=1b6 a3=83630e8 items=1 pid=1226
auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600
sgid=600 fsgid=600 comm="metacity" exe="/usr/bin/metacity"
----
time->Wed Apr  5 15:30:44 2006
type=PATH msg=audit(1144265444.562:8412): item=0
name="/home/dev/.Xauthority-c" flags=310  inode=1278085 dev=03:01
mode=040775 ouid=600 ogid=600 rdev=00:00
type=CWD msg=audit(1144265444.562:8412):  cwd="/home/dev"
type=SYSCALL msg=audit(1144265444.562:8412): arch=40000003 syscall=5
success=yes exit=2 a0=bfae17d3 a1=c1 a2=180 a3=bfae1f10 items=1 pid=1573
auid=4294967295 uid=600 gid=600 euid=600 suid=600 fsuid=600 egid=600
sgid=600 fsgid=600 comm="xauth" exe="/usr/X11R6/bin/xauth"

Thanks,

Steve Brueckner, ATC-NY