On Monday 27 April 2009 06:03:48 pm Kevin Boyce wrote: > I think the auditd package that ships with 5.3 has a bug. There was a memory leak when specifying the NOLOG format option that was fixed in a RHEL5 release last week. Look for audit-1.7.7-6.el5_3.2.rpm. -Steve