> Five previous versions of /var/log/messages at 30K (before > compression) do not run back very far on some machines. Too true - especially if ipf is logging all the packets it drops. The files also seem to compress quite well (about 35k in my case). I seem to be using values much nearer the proposed ones. David -- David Laight: david@l8s.co.uk