Is there an easy way of determining what number fd corresponds to an audit message about fd use? If a fd has a number <=2 then it's probably deliberately being inherited while if it's >2 then someone probably forgot to set close on exec. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/