Keeping with the spirit of this newsgroup, I'm asking this in the form of a question, as I use a version of xterm that does not allow logging at all, for the same reason I don't run a mail.record. The black hats read mail.records as well as xterm logfiles. Question: where does the logfile get recorded? On the servere or at the client? In some cases this may be the same due to NFS mounts. Either way *could* be bad, if I can remotely start an xterm to your server. The reason I ask. Scenario: I remotely start an xterm to your server, after first setting my uid to your uid (i can do this on *my* end since i have root). I set the xterm logfile to be ~home/.rhost. Thus adding a line or more to your .rhost file. xterm in most cases uses unix_auth. I can then login. One step closer to root ;^). Please tell me I'm wrong. Brad