Sam Drinkard wrote on Thu, 15 Dec 2005 13:29:00 -0500: > Just curious why it's now shown as a false start/end where > before, it was not. Hm, did you ever get a "pam_unix" report before? The first thing that comes to mind is that this check must be going wild and accidentally not closing before the next should start or so. I haven't ever seen such a section. Did you check your messages log for unusual pam logging lines? Another option could be to remove all the checks that are before cron (or including cron). If you look at /usr/share/logwatch/scripts services you can see quite a few other check in alphabetical order. Maybe one of them gulps over some log stuff. You could remove them plus the corresponding files in default.conf/* temporarily and see if it stops. Or dare to install a newer Logwatch? The one in Centos 4 is quite old. Logwatch is now at 7.1 and you can install it via rpm. I installed it just a few days ago on several of our machines since it finally looks mature. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com