I’ve just finished to upload the code onto my perforce branch. At the moment the whole code is ready for testing, which means that, now, should be possibile to audit events one-by-one. Specifically I’ve added some functionalities to audit_pipe_ioctl which allow to do the same operation done before but on events list instead of audit classes. Also all the functions needed to manage the events list were made up. The audit_pipe_preselect structure was modified, adding a pid field and a dynamic array of structs which hold the events’ list. The KPI now has two new prototype for audit_pipe_preselect and audit_pipe_submit in order to allow event matching by pid. As soon as the testing period is finished maybe new features will be added. All the code could be found on my perforce branch. I’d really appreciate if anyone willing to help will test the code and give me some feedback. Also please note that the whole code is in a really alpha-stage.That’s all folks,Snagg