Greg, > There is no "/proc/usb/" :)
Sorry, maybe /sys/bus/usb/devices was what I was looking for... > The kernel calls mknod itself on devtmpfs, userspace doesn't do that anymore > (hasn't for a long time). Do you get those audit events today? I'm not auditing those events myself. Just proposing ideas that might produce the sort of information Wade was looking for. kevin
