Thanks David. kernel-2.6.9-5.0.3.EL.audit.27 seems to fix the 32bit syscall parameter problem on X86_64. Thanks! debbie -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20050502/7e17a812/attachment.htm>