On Wednesday 15 March 2006 14:31, Linda Knippers wrote: > I don't understand why this record is a good idea. Because it gives you extra information to search on. Suppose you wanted to see any failed log messages for auid 501. Without the partial record, you won't have the information for ausearch to key on. -Steve