Hi, We can trace Successful Logins and Failed logins by setting $conf['log']['name'] = /tmp/horde.log. But when there is a dictionary attack (for usernames that does not exist), is it possible to trace down the source ip/network? Any idea how to handle this? Thanks in Adv Paras.