http://www.securityfocus.com/infocus/1712 Needless to say, I intend to try this on ISA logs, since the LogParser reads them just fine... Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://www.microsoft.com/isaserver http://isaserver.org/Jim_Harrison http://isatools.org Read the help, books and articles!