On Wednesday 20 May 2009 02:37:01 pm LC Bruzenak wrote: > How can I tell when the rotate is complete so I can move the files out? Use ls -i /var/log/audit/audit.log and watch for the inode to change. Read it first, rotate, and then read again. If you don't see progress after a certain amount of time, you might want to check syslog for problems. -Steve