On Wednesday 15 February 2006 12:17, Linda Knippers wrote: > How can I tell from the audit records that the file name was "(null)" > vs. having "(null)" manufactured by the audit system? ls -i "(null)" and then compare inode values. -Steve