Hi, If possible, could CONFIG_BSD_PROCESS_ACCT_V3 be turned on in the kernels? This will include PID and PPID in the accounting information, which helps a lot during forensics analysis. Kind regards, Thorvald Natvig