On Tuesday 19 April 2005 11:34, Debora Velarde wrote: > # auditctl -a entry,always -F arch=64b -S open > AUDIT_LIST: entry always arch=0 syscall=open OK I found and fixed some minor bugs. However, the main problem here is that you need to use b64 and not 64b. -Steve