Hi, please add the following rule to the logcheck database: For package/daemon auditd: ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ auditd\[[[:digit:]]+\]: Audit daemon rotating log files$ Log line as system event: May 31 11:41:11 localhost auditd[2594]: Audit daemon rotating log files Regards Till