>attached the requested info to bz#160929. This problem has been traced to kernels that do not understand all the new audit message types. They are returning EINVAL in the recvfrom when the audit libs is checking to see if the kernel accepted the message. I think I have the problem fixed by retrying the message using an older message type only when EINVAL is detected. The 0.9.9 version of audit should be in rawhide next time its updated. In the mean time, anyone wanting to test can build the package from the srpm located at http://people.redhat.com/sgrubb/audit/ Thanks, -Steve Grubb __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com