Just as an aside, I was sending in the auditctl event because I do not see the "node=" information in the ausearch results on my collector. So I wasn't certain which machine might be initiating the event. Thx, LCB. -- LC (Lenny) Bruzenak lenny at magitekltd.com