here is a copy of the log: #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer) 2002-01-26 18:05:16 100.180.180.180 - W3SVC2 WEBSERV 100.180.180.202 80 GET /Contact/contactus.htm - 200 0 27902 313 203 HTTP/1.0 www.orsite.com Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+98) - http://www.google.com/search?q=%22contact+us%22&hl=en as you can see the reffering url is from google but the reffering IP is OUR ISA server (100.180.180.180) How can i change the logging of these site so it shows the reffering IP of the user? Thanks Tim