On Monday 13 March 2006 12:00, Kevin Carr wrote: > char ** files = { "/home/admin/log1", "/home/admin/log2", NULL }; > ausearch_init(AUSOURCE_FILES, files) I wonder if we should have AUSOURCE_FILE_ARRAY and AUSOURCE_BUFFER_ARRAY to indicate the pointer being passed is a NULL terminated array of filenames or buffer addresses. -Steve