My `/etc/security/audit_control` is similar to what you've suggested. But i can not see nothing when i do `praudit /dev/auditpipe` except when i do `su` on another terminal tab. Any ideas? Best wishes, Mokhi.