On Tue, 2006-06-06 at 10:58 -0700, M E Fieu wrote: > Thanks how about the following ?? > > ################### LogWatch 4.3.2 (02/18/03) #################### > Processing Initiated: Tue Jun 6 04:02:01 2006 > Date Range Processed: yesterday > Detail Level of Output: 0 > Logfiles for Host: www3 > ################################################################ > > --------------------- sendmail Begin ------------------------ > > Unknown users: > > believeworld0303 > from localhost.localdomain [127.0.0.1] 2 time(s). > > lichungchung > from localhost.localdomain [127.0.0.1] 1 time(s). What don't you understand about this? Someone on this machine tried sending mail to the non-existent users believeworld0303 and lichungchung. Look in /var/log/maillog for those usernames to see when it happened, and possibly more details. And why are you running such an ancient version of logwatch? Paul.