> My solution was simply chmod 700 /etc/crash on all my systems. Root > is the only one that needs it anyway.... Obviously nobody at your site debugs crashed kernels... (Or they don't use crash.) Its enough to just take the sgid bit off the inode. # chmod 511 /etc/crash Jim