Hi, conn.log and known_services.log have a field named "service": sometimes this filed is empty in conn.log but in known_services.log is not...Why? This field should be processed in the same way by the two logs...or not? Thanks, Vito