On Thu, Mar 17, 2005 at 05:52:21PM +0100, Thorvald Natvig wrote: > > Hi, > > If possible, could CONFIG_BSD_PROCESS_ACCT_V3 be turned on in the kernels? > This will include PID and PPID in the accounting information, which helps > a lot during forensics analysis. That sounds reasonable to me as long as a check for any ABI change is made. -- Horms