Steve, > By default all these attempts are logged to the /var/log/auth.log. I > suppose that if you wanted to, you could edit the /etc/syslog.conf file > and change the log choice for auth,authpriv.* from /var/log/auth.log to > /var/log/syslog. The problem was that slink's 'su' doesnt log anything. You have to compile it by yourself. See the other postings in this thread. cu! -- p.