I get this problem on my simple little uniprocessor box.... I may be creating a pattern out of noise, but this problem appears to be weakly correlated with loading a new policy. I spent a bit of time looking at the code to see if I could find a stale pointer in the audit interface. Didn't see anything... Has anyone noticed this running the 'boot policy" (i.e., the same policy the system booted with)? tom -- Tom London