type=SOCKADDR msg=audit(1134746217.580:190): saddr=020014E9E00000FB0000000000000000
If you add the -i parameter to ausearch, it will interpret this so we can see what it means. Dan already has a new policy, so its not needed this time. But its helpful to see this field next time.
Thanks, -Steve
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com