On Ubuntu 14.04 LTS I get : sudo auditctl -a exit,always -F arch=b32 -S listen -S connect Syscall name unknown: listen however with b64 it works Same with the accept syscall. Is that expected ? How can I grab the 32bit calls then ? Thanks, Hassan