Fred Blonder writes: > The limitation of Tripwire in this application is that log files are > ALWAYS (well, almost) changing, so if Tripwire raised the alarm on a > logfile, your reaction should be: "So what?". ;-) I thought that tripwire would report if the log file got smaller, an indication that someone is removing records, yes? At least that seems like a reasonable thing to me. < Paul