On Saturday, December 13, 2014 07:26:09 PM Hassan Sultan wrote: > I can't figure out how to get audit log entries for process termination. > > Abnormal process termination auditing occurs, however for NORMAL process > termination, I can't find anything. Programs typically call exit_group(2) which terminates all threads. -Steve