On Feb 9, 2011, at 1:14 PM, Neslog wrote: > How about the file_flush.bro? When I'm testing I lod that one with a > short time inerval. Good catch. I had a nagging feeling that I was missing something. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro-ids.org/