On RH E WS 4, using swatch v3.1.1, I monitor /var/log/secure. After the logrotate event, the monitoring stopped. Any suggestions? Thanks, Mike. -- Michael D. Berger m.d.berger at ieee.org