Just wanted to point out that I was surprised this morning when I recalled for the first time in about 10 years that the Zeek parser can't handle multiline strings... event zeek_init() { print "Hello, World!"; } That code doesn't work. :) .Seth -- Seth Hall * Corelight, Inc * www.corelight.com