Alexander: Thanks very much for the help. Your input solved the issue. I tweaked the solution a little to put the cron and cron auth messages in the same file. For the archives I have these lines relavant to the issue in syslog.conf: # Main syslog *.info;mail.none;authpriv.none,cron.none,auth.!=info /var/log/messages # Cron messages cron.*,auth.info /var/log/cron Thanks again, Scott