Hi Richard. It looks like the -F exe= option is not supported at all regardless of negation. Starting auditd: [ OK ] -F unknown field: exe ___ John Petrini -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20170612/c560ceb0/attachment.htm>