On Wednesday, August 20, 2014 06:18:35 PM Burn Alting wrote: > Attached is a patch that modifies the --start option to take the string > 'checkpoint' as an option. It will then extract the timestamp found > within the given checkpoint file and use that as the start time to emit > audit events for. Thanks for the patch! Applied as commit 997. -Steve