00:34:44 <pjustice> Replacement audit stream question.  Processes that I'm pretty sure are not running as root are e.g. doing a chmod, for which I get a record, but the uid and gid fields in the subject64 token are 0.