Hello, I was wondering what was the correct way to send a netmask in an audit message? Can I simply add it to the end of the 'addr' field: addr=10.0.0.0/8 Or is there some other field specifically for the netmask? addr=10.0.0.0 X=8 -- paul moore linux security @ hp