Can we make the i_audit field in struct inode dependent on CONFIG_AUDITFILESYSTEM? As I understand it, this watches only extant inodes. You can't watch for attempts to read or create a non-existent file. Is that functionality not required? I'll refrain from heckling about locking since you mentioned it yourself :) -- dwmw2