Sorry, I got trigger happy with the "delete" key... so this message is a little out of order... Eero Volotinen wrote: > how about using auditd or ossec ? And it looks like auditd may be exactly what I need. Thanks! -- rgds Stephen