On Sunday, June 12, 2011 10:16:45 AM Mr Dash Four wrote: > > - Parse and interpret NETFILTER_PKT events correctly > > Does that include the new "obj" field? :-X No, it does not. I don't make changes like that until a kernel is released or at least in RC status. There will be future audit package releases where this will be picked up. -Steve