Hi, I was wondering why the code in audit_log_exit http://lxr.linux.no/source/kernel/auditsc.c?v=2.6.8.1#L582 loops spitting out packets? Why isn't the audit information sent as 1 packet? Just curious... -Steve Grubb