Came across this article on log monitoring... http://arstechnica.com/columns/linux/linux-20050519.ars The tool itself is here: http://kodu.neti.ee/~risto/sec/ May be useful in the hobbit world. Craig Cook -- Systems Monitoring Consulting and Support Services http://www.cookitservices.com