If the audit messages would shift up 1 from the first_event you could track the performance of the audit daemon. Having 2 messages typed with the same number is confusing. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190119/dd64c4a0/attachment.htm>