On Wednesday 15 March 2006 15:33, Amy Griffis wrote: > Why can't a user just disable syscall auditing if they aren't > interested in adding rules? because then the avc messages go to syslog. -Steve