Hello, I've been using auditd with the the capp rules on RHEL4, and all is well. In addition to recording system calls, file activity etc, I would like to record issued commands, ie. anything typed into a shell by a user. Is this a reasonable thing to do with auditd? Is it possible? Thanks, Gavin