On Thursday 24 May 2007 19:07:21 Michael Folsom wrote: Logins are denoted by a USER_LOGIN event. There should also be a USER_START event from the same tty/pty or host, auid, and pid. This marks the beginning of a session. You should be able to look for a corresponding USER_END to denote the end of a session. If USER_START results indicates a failure, there will not be a USER_END. With a little inference, its possible. I started to put in a USER_LOGOUT event, but I decided its redundant when it can be inferred by the session events. -Steve