Jim, I have the SMTP filter installed on its own box which communicates with the ISA server which has its own box. The filters work as does the relay in both directions. I know how to configure the alerts and those are working too. What I want to know is, is the alert only kicked off with a command rule or do attachment and keyword rules also initiate the alert? And also, are there logs when an alert is created or can they only be viewed by the ISA management console or NT event viewer or email? Nathan