When be talk about "xterm" and its capability to write utmp records: wouldn't the right solution be to have a special purpose daemon listening on some socket in /var/run, where interested programs can send their log info to, and have things like xterm always run completely unpriviledged? Regards, Ignatios