Quoting "Marco C. Coelho" <maillist1 at argontech.net>: > How do you correlate account to signature? I would rather find the > compromised accounts. The log snippet you posted cut out the end of the UPDATE statement, which would have had the user_uid value (which is the account name). -chuck