When I looked at the log files this morning the first time of entry in all 3 logs was at 9:21 am. I got several of the following alerts during the night and in the morning before 9:21 am. "ISA Server alert: A packet with invalid IP options was detected and the packet was dropped." My question is how come there is nothing in the logs before 9:21 am? If I got these alerts before then, shouldn't there be entries in the IP log for those alerts? Thanks, Larissa