How difficult would it be to add 'old state->new state' to the log on a change in the enforcing state? Currently, 'setenforce' appears to be logged as a toggle.... tom