See <bsm/audit.h> and related headers in the xnu/bsd/bsm directory for details on the audit subsystem in 10.3.4 (Darwin 7.4). What gets audited is any syscall with an authorization check in it (as well as several user-leve authorizations done by ssh, etc..). File accesses are pre-authorized through the open call, so the individual read() and write() calls are not audited. --Jim [demime 0.98b removed an attachment of type application/pkcs7-signature which had a name of smime.p7s] _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.