Delving into some auditing packages, psacct looks great, but wondering if there's a way to get more details about the results for the lastcomm command - for example: lastcomm jtrutwin rm jtrutwin pts/1 0.00 secs Tue Feb 8 12:41 rm jtrutwin pts/1 0.00 secs Tue Feb 8 12:41 grep jtrutwin pts/1 0.00 secs Tue Feb 8 12:41 That's all fine and good but is there anything in psacct that tells you more details such as what was rm'd? Josh