This may not be appropriate for this list, if it isn't I apologize and you may ignore it. Is there an quick way to resolve the syscall number that auditd returns within a message to a syscall name? (ie. 5->open)? I am programming in C, if that helps. Thanks, Steve