In the man page it is written that *core dump on SIGXCPU **can fail* . That is probably the reason why it is not logged. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20131105/d5d0baab/attachment.htm>