Robert has written a DTrace audit provider which is now being tested. Can turn on audit instrumentation in the kernel and then collect the data via probes at a later point. There are two types of probes one of which collect BSM audit data and one which collects raw data. Likely to go up for review in a month. Does not use SDT probes, but is a full, new provider.