Steve, Audit 1.6.7 prelude event adds look great - the extra info in the prelude manager is very good. Events: In the audisp code I see most of the AUDIT_ANOM "biggies" but not all (from libaudit.h, e.g. AUDIT_ANOM_ROOT_TRANS)? Also - gotta ask - user logins but not logoffs? Thanks, LCB. -- LC (Lenny) Bruzenak lenny at magitekltd.com