When logwatch reports that a host probed the server, what information does it use to determine that? I tried to grep for the IP address that did the probing in /var/log/* and came up empty handed. Thanks...Jeff