Should the following work??? auditctl -a exit,always -S all -F exit=-13 When I use a negative value for exit, I get no output into the logs when I should. I am using audit-1.2.3 on SuSE Enterprise 10 with the 2.6.16.21 kernel. Thanks, Lane