On Friday 29 August 2008 04:55:47 Yu Zhiguo wrote: > The field of 'syscall=all' is redundant for fielter 'exclude', > so it should be deleted, e.g. > # auditctl -l > LIST_RULES: exclude,always syscall=all > > should be: > LIST_RULES: exclude,always Applied. Thanks for the patch ! -Steve