I haven't been following this thread very closely since my last post, but if you want to know who is doing what ... use auditctl. <http://kbase.redhat.com/faq/docs/DOC-10108> Barry _______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos