On Mar 19, 2013, at 4:29 PM, Tritium Cat <tritium.cat at gmail.com> wrote: > Makes more sense when you consider a single Bro process. I'm not sure what you mean by this? Logs don't really have anything to do with multiple processes in most cases. .Seth -- Seth Hall International Computer Science Institute (Bro) because everyone has a network http://www.bro.org/