Hello, audit_log_acct_message() is currently quoting acct differently from all other users: it adds quotes to acct if it is represented in hexadecimal, not when it is represented as-is. The attached patch fixes it - but it also changes the format of some of the most-often used messages. It might be better to leave the message format alone, and add a special case to libauparse and other applications that parse the logs - I have no idea. Mirek