On Wednesday 06 August 2008 04:12:42 Zhang Xiliang wrote: >I think the missing value for -F should be checking. > >For example, >auditctl -a exit,always -F pid= <snip> > + if (*v == NULL) > + return -20; I changed these to (*v == 0) since it is a char and not a pointer. Thanks for the patch! Applied -Steve