On Tuesday 27 May 2008 12:16:18 LC Bruzenak wrote: > > That is why we added the node field. :) You should probably enable it > > with the name_format option. > > I think I do have it: > > [root at hugo audit]# grep name_format /etc/audit/auditd.conf > name_format = hostname You may also need to make the same change in /etc/audisp/audispd.conf. -Steve