On 01/03/2014 07:58 AM, David Flatley wrote: > When running "ausearch -i", does this read both > the /var/log/audit/audit.log and the rotated log files in the same > directory? Thanks. It does, unless you specify the "-if <FILE>" option. Remember: if called from a cron script, use the "--input-logs" option. LCB -- LC (Lenny) Bruzenak lenny at magitekltd.com