>recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\311_\0\0\352\377\377\377|\0\0\0"..., 8476, This is your problem. 352 is octal for -EINVAL. Your kernel doesn't understand the netlink message type that the audit-libs is sending. I put audit-libs-0.9.10 into rawhide and it should be available next time its pushed out. If you feel like building it yourself, you can get it from people.redhat.com/sgrubb/audit -Steve Grubb ____________________________________________________ Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football http://football.fantasysports.yahoo.com