Hi All, Can anyone point me in the right direction in how to set up auditd on a RHEL 4 update 4 box. Can I monitor just files or directories? If so what are the rules to do this. Or if someone has a document that outlines this procedure. Regards, -- Lennart Andersen St Thomas, Ontario lka0871 at rogers dot com ----------------------------