On Mon, 2008-05-12 at 12:12 -0400, John Dennis wrote: > It should also be a goal that correct parsing of audit logs not be > dependent on specific kernel versions. I've heard you say this a number of times. Can you let me know specific examples of what you had to code around due to specific kernel versions since the audit system started to settle down? -Eric