Thanks. I'll try that. Still can't figure out why the rules I try to add to audit.rules won't take. Still get "invalid argument" to place watches on files.