Hi I used to capture logs shown on a Sun servers /dev/console (bootup, crash/panic & shutdown messages amongst them) by using a smaller Sun server to telnet to a terminal server which is connected to the "to be captured" Sun servers' consoles. Is there any equivalent for Linux? Can I connect up to Com1 or Com2 ports of the PC server hardware running Linux? When the auditor requires "audit trail", do they normally ask for "psacct" & "sudo" logs only or what? Kindly share what your auditors/security guys asks for when they ask for audit trail. I come from OpenVMS background & to me "audit trail" means screen logging & keylogging everything that's entered by System Admin/support personnel (in Unix equivalent, the moment you login, you issue "script logfile; then do whatever ...; exit" - the scripted logfile is what's needed Thanks Roger