On Wednesday 02 August 2006 16:49, Lane Williams wrote: > Should the following work??? Yes. > auditctl -a exit,always -S all -F exit=-13 If this does not work, we will need a kernel patch for it. -Steve