On Wednesday 15 March 2006 15:58, Jason Baron wrote: > couldn't auditd keep track of the number of rules and enable or > disable syscall auditing as appropriate? The simple answer is no. -Steve