Is there a reason that the audit tools that take a file name paramater (-if) are not executable by non-root users? This prevents their use by an admin to do analysis of saved audit logs with an unprivileged user login. Thanks - Karl