In looking at the user application audit I'm wondering why there is a "hostname" field there? I understand the obvious answer but would think I'd trust the auditd or audispd more than an application for the hostname answer, and those would be consistent. Thx, LCB. -- LC (Lenny) Bruzenak lenny at magitekltd.com